6 ms·

How crazy is it that getting root on your own device is an accomplishment? Edit: I didn't realize this post is about a privilege escalation exploit, not about

How crazy is it that getting root on your own device is an accomplishment? Edit: I didn't realize this post is about a privilege escalation exploit, not about getting root on your own device necessarily. My point still stands though.

count 4y ago
Many, many macOS devices are not 'your own' devices, and have access to many development backends and infrastructures.
- TheRealPomax 4y ago
  That has nothing to do with this. Everyone can become root on their mac by typing their password. This exploit shows that you you can compile a bit of code that can then bypass that and run anything it wants with full root permissions.
  - andix 4y ago
    Only if you have admin permissions. If you don’t have them, you need to type in the password of an admin to become root.
  - dvzk 4y ago
    In most cases, yes, but that's not what the parent meant. In managed environments, it's common to not have root login access, and local privilege escalation is sometimes more critical than normal.
fathyb 4y ago
This is a privilege escalation exploit, it gets a root shell from a non-root process. You can get root privileges on macOS using su/sudo.
jackson1442 4y ago
it's privilege escalation, the script is not being run as sudo also you can enable root by going to Directory Utility -> (unlock) -> Edit -> Enable Root User. Haven't found a need for this though.
mritun 4y ago
Flamebait? If you know the password you can enter it when ‘su’ asks. This vulnerability allows all processes, even untrusted one, to gain root privileges- which is a problem if that is not what you intend. MacOS is actually less locked down than a Linux server built by even a half competent sysadmin.
- gjsman-1000 4y ago
  > MacOS is actually less locked down than a Linux server built by even a half competent sysadmin. In no way is this true. Linux servers built by half-competent sysadmins don't have System Integrity Protection, read-only boot images with digital signatures, or even proper secure boot.
  - astrange 4y ago
    Or any of the ARM hardware security features like PAC.
akerl_ 4y ago
The vulnerability isn’t that the person who owns the machine can get root. Your user on a personal Mac is, by default, an Administrator, and can just sudo to root. The “accomplishment” is that somebody who can execute code on your laptop (say, somebody who notices you forgot to lock your laptop at Starbucks, or a malicious app developer, or somebody who compromises the update server for an app you use) can escalate to root.
TheRealPomax 4y ago
For a random bit of code that's running on your machine? zero day levels of crazy: that should never be possible, and you should update your macos if you haven't yet. This is not about "you being able to become root", of course you can do that whenever you want, with authentication. This is a random bit of code that compiles to something that goes "cute, let me just get root access without any passwords or user noficiations. Tadah, I can do whatever I want on this system now"
- lucb1e 4y ago
  > This is not about "you being able to become root", of course you can do that whenever you want "of course", yeah... Tell that to iOS and most Android users (even among techies, 95% is afraid of the steps you have to take for getting root on your own damn phone). This used to be normal but for our own good it has been decided that this is not normal now anymore. That kids are growing up with this worries me. When is the market ready for Microsoft and Apple to decide the same for desktops? Not running the DRM and trying to WINE some application is going to be similarly thwarted as doing banking on a phone that the user fully owns is today.
  - TheRealPomax 4y ago
    How are personal gripes about phone operating systems even remotely related to the factual matter of being able to su/sudo whenever you want on a desktop operating system?
    - deleted 4y ago
      [deleted]
    - lucb1e 4y ago
      Just pointing out that what you take for granted today is being removed from newer systems (which additionally relates to the thread as a whole since it uses an alternative way to get ownership over the software running on the device), so maybe it's not such an 'of course' anymore in the way you said :( Sorry that I wasted your time with my, eh, "personal gripes"
waynecochran 4y ago
It doesn't have to be your machine -- imagine this is a Mac in a lab or a cloud machine.
andix 4y ago
It depends. Privilege escalation can allow rootkits to install themselves. To get a really severe exploit you usually need to combine a remote code execution with a privilege escalation. So this would only be one part. But you never know if somebody already has another zero day exploit in their pocket and waits for such an opportunity. Some bugs are there for years before they are found. This doesn’t mean that nobody found them before. It only means that nobody used them in a way that it got detected.
- e40 4y ago
  Is a rootkit possible with SIP turned on? Seems like that’s what it is designed to prevent.
  - deleted 4y ago
    [deleted]
reaperducer 4y ago
How crazy is it that getting root on your own device is an accomplishment? We're not living in Commodore 64 days anymore. The vast majority of people have to be protected from themselves, or they'd all be following online instructions to delete files in Win32 to free up space. On HN, people know what they're doing, but for some reason complain as if every person on the planet has the same level of technical knowledge they do. They don't. People on HN like to moan about not being able to hack stuff because they think it gives them street cred. It doesn't. HN: "This product is awful! It has no security!" Also HN: "This product is awful! Its has security!"
- TillE 4y ago
  Right, the hard question is how do you prevent the spread of trojan horses which use basic social engineering? It's not difficult to get people to run a sketchy program and type their password into any old prompt. You need layers upon layers of security to mitigate this.
- adra 4y ago
  It is as it always was an attitude of trust and defaults. You can get locked down bootloaders that only load windows and specifically signed Linux distros. This is totally fine for the 99%, but still most bios allow you to drop into non-secureboot if you choose. They've given the trust that you're going to do so responsibly. No random is going to do this for lols. It's largely for enthusiasts and non-institutional professionals building their stacks. This is the have your cake and eat it too. Android has its "dev" mode, and most android phones allow for bootloader unlocks. Giving people to option to explicitly drop the security for their own reasons is great as long as the default is " idiot proof". Who's complaining about this model? Nobody
- spookthesunset 4y ago
  And honestly there are way cooler “raw hardware” things out there now that you can tinker with. ESP32 or even an Arduino can run circles around a C64 as far things you can do… (at least I can think of… who knows what my life would be like growing up around $5 microcontrollers with easy to use IO and whatnot…)

count 4y ago

Many, many macOS devices are not 'your own' devices, and have access to many development backends and infrastructures.

TheRealPomax 4y ago
That has nothing to do with this. Everyone can become root on their mac by typing their password. This exploit shows that you you can compile a bit of code that can then bypass that and run anything it wants with full root permissions.
- andix 4y ago
  Only if you have admin permissions. If you don’t have them, you need to type in the password of an admin to become root.
- dvzk 4y ago
  In most cases, yes, but that's not what the parent meant. In managed environments, it's common to not have root login access, and local privilege escalation is sometimes more critical than normal.

fathyb 4y ago

This is a privilege escalation exploit, it gets a root shell from a non-root process. You can get root privileges on macOS using su/sudo.

jackson1442 4y ago

it's privilege escalation, the script is not being run as sudo also you can enable root by going to Directory Utility -> (unlock) -> Edit -> Enable Root User. Haven't found a need for this though.

mritun 4y ago

Flamebait? If you know the password you can enter it when ‘su’ asks. This vulnerability allows all processes, even untrusted one, to gain root privileges- which is a problem if that is not what you intend. MacOS is actually less locked down than a Linux server built by even a half competent sysadmin.

gjsman-1000 4y ago
> MacOS is actually less locked down than a Linux server built by even a half competent sysadmin. In no way is this true. Linux servers built by half-competent sysadmins don't have System Integrity Protection, read-only boot images with digital signatures, or even proper secure boot.
- astrange 4y ago
  Or any of the ARM hardware security features like PAC.

akerl_ 4y ago

The vulnerability isn’t that the person who owns the machine can get root. Your user on a personal Mac is, by default, an Administrator, and can just sudo to root. The “accomplishment” is that somebody who can execute code on your laptop (say, somebody who notices you forgot to lock your laptop at Starbucks, or a malicious app developer, or somebody who compromises the update server for an app you use) can escalate to root.

TheRealPomax 4y ago

For a random bit of code that's running on your machine? zero day levels of crazy: that should never be possible, and you should update your macos if you haven't yet. This is not about "you being able to become root", of course you can do that whenever you want, with authentication. This is a random bit of code that compiles to something that goes "cute, let me just get root access without any passwords or user noficiations. Tadah, I can do whatever I want on this system now"

lucb1e 4y ago
> This is not about "you being able to become root", of course you can do that whenever you want "of course", yeah... Tell that to iOS and most Android users (even among techies, 95% is afraid of the steps you have to take for getting root on your own damn phone). This used to be normal but for our own good it has been decided that this is not normal now anymore. That kids are growing up with this worries me. When is the market ready for Microsoft and Apple to decide the same for desktops? Not running the DRM and trying to WINE some application is going to be similarly thwarted as doing banking on a phone that the user fully owns is today.
- TheRealPomax 4y ago
  How are personal gripes about phone operating systems even remotely related to the factual matter of being able to su/sudo whenever you want on a desktop operating system?
  - deleted 4y ago
    [deleted]
  - lucb1e 4y ago
    Just pointing out that what you take for granted today is being removed from newer systems (which additionally relates to the thread as a whole since it uses an alternative way to get ownership over the software running on the device), so maybe it's not such an 'of course' anymore in the way you said :( Sorry that I wasted your time with my, eh, "personal gripes"

waynecochran 4y ago

It doesn't have to be your machine -- imagine this is a Mac in a lab or a cloud machine.

andix 4y ago

It depends. Privilege escalation can allow rootkits to install themselves. To get a really severe exploit you usually need to combine a remote code execution with a privilege escalation. So this would only be one part. But you never know if somebody already has another zero day exploit in their pocket and waits for such an opportunity. Some bugs are there for years before they are found. This doesn’t mean that nobody found them before. It only means that nobody used them in a way that it got detected.

e40 4y ago
Is a rootkit possible with SIP turned on? Seems like that’s what it is designed to prevent.
- deleted 4y ago
  [deleted]

reaperducer 4y ago

How crazy is it that getting root on your own device is an accomplishment? We're not living in Commodore 64 days anymore. The vast majority of people have to be protected from themselves, or they'd all be following online instructions to delete files in Win32 to free up space. On HN, people know what they're doing, but for some reason complain as if every person on the planet has the same level of technical knowledge they do. They don't. People on HN like to moan about not being able to hack stuff because they think it gives them street cred. It doesn't. HN: "This product is awful! It has no security!" Also HN: "This product is awful! Its has security!"

TillE 4y ago
Right, the hard question is how do you prevent the spread of trojan horses which use basic social engineering? It's not difficult to get people to run a sketchy program and type their password into any old prompt. You need layers upon layers of security to mitigate this.
adra 4y ago
It is as it always was an attitude of trust and defaults. You can get locked down bootloaders that only load windows and specifically signed Linux distros. This is totally fine for the 99%, but still most bios allow you to drop into non-secureboot if you choose. They've given the trust that you're going to do so responsibly. No random is going to do this for lols. It's largely for enthusiasts and non-institutional professionals building their stacks. This is the have your cake and eat it too. Android has its "dev" mode, and most android phones allow for bootloader unlocks. Giving people to option to explicitly drop the security for their own reasons is great as long as the default is " idiot proof". Who's complaining about this model? Nobody
spookthesunset 4y ago
And honestly there are way cooler “raw hardware” things out there now that you can tinker with. ESP32 or even an Arduino can run circles around a C64 as far things you can do… (at least I can think of… who knows what my life would be like growing up around $5 microcontrollers with easy to use IO and whatnot…)