5 ms·
Note that if SIP is enabled (the default), "root access" does not mean full compromise. On macOS, root is far from being as privileged as it was in the old days
by anyfoo 4y ago
Note that if SIP is enabled (the default), "root access" does not mean full compromise. On macOS, root is far from being as privileged as it was in the old days of UNIX yore. (Even on Linux it does not have to be, but my impression is that on most distributions it probably still is.)
Just because you're root does not mean you get any entitlement you want, or arbitrary access to the whole filesystem, arbitrary memory access (a la /dev/(k)mem), or can replace the kernel just like that.
(That's also probably why you don't hear of iPhones being "rooted", but rather "jailbroken". Just being root on an iPhone wouldn't do that much.)
Make no mistake, this is still a privilege escalation attack and needs to be fixed.
- jbverschoor 4y agoI don’t need root access.. just your .ssh dir
- ssizn 4y agoGood luck bypassing my CGNAT ;)
- jbverschoor 4y agoWell.. with ipv6, there’s no need to nat anymore
- aidos 4y agoThough you should keep your private keys protected by a pass phrase. Top tip for people that use 1Password: I’ve discovered recently that you can run it as an ssh agent. That way your keys never leave the 1password app.
- NavinF 4y agoEither you're forced to type in your password 100 times a day (so the rootkit has to wait until you type it in) or you use ssh-agent and your decrypted key is in memory for all to see.
- microtonal 4y agoIndeed. Use the Mac’s Secure Enclave [1] or a Yubikey, preferably with Touch ID or touch confirmation on a YK. https://github.com/maxgoedjen/secretive https://github.com/maxgoedjen/secretive
- aidos 4y agoJudging by the downvotes, my suggestion isn't great, though it does seem a tiny bit better. I was under the impression that 1password uses secure enclave on the Mac and that it only decrypts the key as it's needed. I guess depending on the implementation the decrypted key could be in memory for a moment - or maybe longer.
- snowwrestler 4y agoThe GP said they just need access to your .ssh directory (not root access, no mention of a root kit). A pass phrase on the key is a valid mitigation for that level of access. You don’t need to type it, you can store it in a password manager and copy/paste, which is pretty fast. I do it all the time, it’s not a big deal.
- NavinF 4y agoOk fair, but IMO there are few threat models where that would make a difference. In practice the attacker can just edit your bashrc and alias ssh-agent to log the password. Same for the password manager. Btw user mode rootkits are a thing and they typically don't need root despite the name. If attacker code can run under your user, you're kinda screwed.
- fulafel 4y agoThis would be just a minor speed bump if the adversary has control of the user account.
- woadwarrior01 4y agoAnd I’d though everyone else also kept their gpg and ssh keys on Yubikeys[1]. [1]: https://github.com/drduh/YubiKey-Guide https://github.com/drduh/YubiKey-Guide
- microtonal 4y agoOr in the Secure Enclave on Macs. https://github.com/maxgoedjen/secretive https://github.com/maxgoedjen/secretive
- hk1337 4y agoI don’t store them on it but I do require it to use it.
- matheusmoreira 4y agoI keep my subkeys on my YubiKey and my master key on a printed QR code in a safe. Submitted some binary data decoding patches to ZBar just to make this easier.
- hk1337 4y agoYou’re going to need my U2F key too.
- userbinator 4y agoI read your first 8 words and was momentarily confused because I thought you were referring to https://en.wikipedia.org/wiki/Session_Initiation_Protocol https://en.wikipedia.org/wiki/Session_Initiation_Protocol , and can indeed join Zoom meetings with a standard SIP client, but it's an optional paid feature --- nonetheless likely to be available in a corporate environment. Look for the IP address to dial in meeting invites to see if you have that option.
- tedmiston 4y agoSIP is System Integrity Protection https://en.m.wikipedia.org/wiki/System_Integrity_Protection https://en.m.wikipedia.org/wiki/System_Integrity_Protection
- usrnm 4y agoYou still need some way to be able to manage the system and have unrestricted access to admin stuff. Moving the problem to some other place doesn't really solve it
- anyfoo 4y agoWell if that other place is having to have the device in physical possession, and having to enter the admin password in person, before you can e.g. replace the kernel or critical system libraries... https://help.apple.com/pdf/security/en_US/apple-platform-security-guide.pdf https://help.apple.com/pdf/security/en_US/apple-platform-sec...
- eu 4y agoTried `rm -rd /` as root on a Mac once. I didn’t expect it to boot just fine after :)
- hungryforcodes 4y agoSo what DID happen after? :)
- dev_tty01 4y agoWell, in recent Mac systems '/' is read only so nothing will happen.
- ddtaylor 4y agoCan't SIP just be turned off by using root?
- przemub 4y agoNo - you need to boot the system into the recovery mode so you would need the exploit to be working in that mode.