3 ms·

> "empty password tried twice" root login bypass Sounds like the time my cat hacked my Sun 3/60 by simply sitting on the keyboard. XDM crashed when the userna

> "empty password tried twice" root login bypass Sounds like the time my cat hacked my Sun 3/60 by simply sitting on the keyboard. XDM crashed when the username buffer hit 256 random characters, and then dropped a root shell. But this was in the early 90's when everybody was a lot more innocent about security.

nmgycombinator 2y ago
I feel like that (innocence about security) might be a bit of the reason why this vulnerability existed in the first place. I'm sure the NetAuthAgent code is very old, and was probably written at a time before even Apple was serious about security. And what really can you add new to a web server client? I wouldn't be surprised if the entitlement check is the first thing they've added to it in years. It's funny, Apple themselves even suggest people use other apps for FTP: https://support.apple.com/guide/mac-help/servers-shared-computers-connect-mac-mchlp3015/15.0/mac/15.0 https://support.apple.com/guide/mac-help/servers-shared-comp... > With read-only access, you can copy files from the server, but to copy files to the server, you may need another FTP app. Choose Apple menu  > App Store to find FTP apps available for macOS. Another funny note: NetAuthAgent has had a bug for years where you cannot connect to an FTP server if your username contains an `@` symbol. I understand the technical reasons for that, but it is technically supported by the spec and other clients work with it just fine. I'd dig up some old posts talking about it going back years, but I don't want to put in the effort, lol.
- retox 2y ago
  >NetAuthAgent has had a bug for years where you cannot connect to an FTP server if your username contains an `@` symbol. Basic auth and FTP had a username password schema like ftp://username@ftpserver.address.com and even ftp://username:password@ftpserver.address.com
  - nmgycombinator 2y ago
    > I understand the technical reasons for that, but it is technically supported by the spec and other clients work with it just fine. I am completely aware of that, but I am aware that other clients handle it just fine. The bug actually forced me to use a different client for when I actually needed an FTP client.
    - hunter2_ 2y ago
      I would've guessed that once it's established that the bug is caused by the app injecting the specified username into the USERINFO portion of a URL without the necessary percent-encoding, a workaround (other than using a different client) would be to manually percent-encode the username, i.e., replace the "@" with "%40" ... although this wouldn't work if the app actually did percent-encode an entered "%" despite not encoding an entered "@"!
      - nmgycombinator 2y ago
        Fascinating. I'll have to test that out!
saghm 2y ago
> But this was in the early 90's when everybody was a lot more innocent about security. There are definitely more recent flaws that might have been suspectible to "cat butt on keyboard", like this one in 2016: https://www.bleepingcomputer.com/news/security/linux-flaw-allows-root-shell-during-boot-up-for-luks-disk-encrypted-systems/ https://www.bleepingcomputer.com/news/security/linux-flaw-al...
- esdf 2y ago
  And more! https://bugzilla.gnome.org/show_bug.cgi?id=758032 https://bugzilla.gnome.org/show_bug.cgi?id=758032 https://github.com/linuxmint/cinnamon-screensaver/issues/354 https://github.com/linuxmint/cinnamon-screensaver/issues/354
nickdothutton 2y ago
Thanks for reminding me about XDM a source of seemingly infinite vulnerabilities.
dogma1138 2y ago
Freakazoid moment…
kps 2y ago
> … hacked my Sun 3/60 L1-A to bring up the boot monitor. Search memory for `/bin/login` and replace with `bin/ed`. Enter any file name as your ‘user’ name, or just junk, and use `!sh`. (Amazing what you remember from school…)
- jeffs4271 2y ago
  Glad to see vax and 68k sun guys of my vintage here still. The security game was different then. Miss the simple life. :-)
pixl97 2y ago
I remember using Novell netware in high school and if you random long lengths of passwords you could get the machine to crash. Didn't have any idea what was going on at the time. After highschool I saw an exploit for this where if you typed the right magic characters in you could highjack the execution of the login prompt and get a shell.
- junon 2y ago
  Novell was really bad at locking down machines lol. It was namely susceptible to the windows XP `at.exe cmd.exe` root shell bypass. Got in trouble a few times during school years doing that.
SoftTalker 2y ago
MacOS is descended from NeXTSTEP which dates back to the 1980s. There is probably a lot of terrible code in there. Edit: terrible from today's security perspective, I meant.
- nmgycombinator 2y ago
  Take a look at it yourself if you're curious. The kernel code is open source: https://github.com/apple-oss-distributions/xnu https://github.com/apple-oss-distributions/xnu
486sx33 2y ago
Certain DOCSIS cable modems … had a similar flaw “With many users now using modified config files to uncap their modems, most cable modem service providers acted to defeat this exploit by turning on the DOCSIS security feature that requires the CMTS to check the authenticity of the modem's config file during the registration process (this is explained in more detail in Chapter 9). As previously mentioned, this checksum is a HMAC-MD5 digest of the entire config file that uniquely iden- tifies its original contents, and it is constructed from the config file using a password chosen by the ISP. This defeats config file exploits because a user 8 Chapter 1| cannot create a checksum that would validate a modified config file without knowing the password that was used by the service provider when the original config file was created. Defeating the Message Integrity Check The fact that the systems of most ISPs had now been patched to prevent this type of uncapping was a challenge to be overcome. I began by attempting to hack the patch that the ISPs had implemented. My starting point was a phrase that was displayed in the modem's HTTP log page when the method described in the uncapping tutorial failed. The logs would read TFTP file complete-but failed Message Integrity check MIC. I wondered how I could bypass this message integrity check or MIC. One morning I awoke to frantic beeps coming from my computer; a member of my group was messaging me. He had the answer. The way to bypass the MIC was not to include the MIC! As simple as that might sound, I had no idea what he was talking about. He then sent me a copy of his config file and had me open it up in a basic hex editor (a program used to examine and modify binary files). The config file normally contained two different checksums at the end of the con- fig file: a standard MD5 checksum of the config, followed by another check- sum, the dreaded HMAC-MD5 (also known as the CmMic). He had simply trun- cated the config file, removing the HMAC-MD5 checksum and the two bytes before it (its header). Remarkably, this allowed any config to be used on any ISP. Once again, every ISP around the world was vulnerable to OneStep. NOTE This hack worked because the developers of the firmware used in the ISPs' routers, which process the config files and CMTS checksums sent from the modems, had not thoroughly tested the finished code. The basic config file processing function in the firmware would process operation codes (opcodes) that were present in the config file, including the CmMic opcode, and carry out the associated actions. But it would not check to confirm that the CmMic opcode had actually been sent (or even that the config file had success- fully authenticated). This flaw was severe because the ISP operators could not directly fix it in their routers; the only ones who could do so were the third-party vendors who supplied the firmware for the CMTSs. It would be a long time before the individual systems could be patched.”
spullara 2y ago
back in the 80s I got into a DEC system by doing roughly the same thing to an application running on VMS. basically you when it interrogated the terminal you could overflow it and drop into the command line.
dhosek 2y ago
I remember the first time I encountered a Windows machine you had to log in to to use (1996). At my first job, I had write access to all the system directories on the corporate VAX machine. I could have easily taken down a major corporation through a careless mistake (but fortunately, never did).
nine_k 2y ago
Back in the day, on my first day in a huge corporation famous for its refined engineering culture, I was issued a laptop that had some installation program running, to create a user for me, enroll on the corp network, etc. It had a bug, which made it run certain actions in an infinite loop. I pressed Ctrl+C, and got a root shell. From it, I ran the enrollment scripts I could find; it gave me sufficient access to pull from the corporate repo. So I took a ticket, found a related bug in the code, and created a patch fixing it on the first day, technically by cracking into a corporate laptop. (I had to wait for a properly completed enrollment to be able to push the code.)

nmgycombinator 2y ago

I feel like that (innocence about security) might be a bit of the reason why this vulnerability existed in the first place. I'm sure the NetAuthAgent code is very old, and was probably written at a time before even Apple was serious about security. And what really can you add new to a web server client? I wouldn't be surprised if the entitlement check is the first thing they've added to it in years. It's funny, Apple themselves even suggest people use other apps for FTP: https://support.apple.com/guide/mac-help/servers-shared-computers-connect-mac-mchlp3015/15.0/mac/15.0 https://support.apple.com/guide/mac-help/servers-shared-comp... > With read-only access, you can copy files from the server, but to copy files to the server, you may need another FTP app. Choose Apple menu  > App Store to find FTP apps available for macOS. Another funny note: NetAuthAgent has had a bug for years where you cannot connect to an FTP server if your username contains an `@` symbol. I understand the technical reasons for that, but it is technically supported by the spec and other clients work with it just fine. I'd dig up some old posts talking about it going back years, but I don't want to put in the effort, lol.

retox 2y ago
>NetAuthAgent has had a bug for years where you cannot connect to an FTP server if your username contains an `@` symbol. Basic auth and FTP had a username password schema like ftp://username@ftpserver.address.com and even ftp://username:password@ftpserver.address.com
- nmgycombinator 2y ago
  > I understand the technical reasons for that, but it is technically supported by the spec and other clients work with it just fine. I am completely aware of that, but I am aware that other clients handle it just fine. The bug actually forced me to use a different client for when I actually needed an FTP client.
  - hunter2_ 2y ago
    I would've guessed that once it's established that the bug is caused by the app injecting the specified username into the USERINFO portion of a URL without the necessary percent-encoding, a workaround (other than using a different client) would be to manually percent-encode the username, i.e., replace the "@" with "%40" ... although this wouldn't work if the app actually did percent-encode an entered "%" despite not encoding an entered "@"!
    - nmgycombinator 2y ago
      Fascinating. I'll have to test that out!

saghm 2y ago

> But this was in the early 90's when everybody was a lot more innocent about security. There are definitely more recent flaws that might have been suspectible to "cat butt on keyboard", like this one in 2016: https://www.bleepingcomputer.com/news/security/linux-flaw-allows-root-shell-during-boot-up-for-luks-disk-encrypted-systems/ https://www.bleepingcomputer.com/news/security/linux-flaw-al...

esdf 2y ago
And more! https://bugzilla.gnome.org/show_bug.cgi?id=758032 https://bugzilla.gnome.org/show_bug.cgi?id=758032 https://github.com/linuxmint/cinnamon-screensaver/issues/354 https://github.com/linuxmint/cinnamon-screensaver/issues/354

nickdothutton 2y ago

Thanks for reminding me about XDM a source of seemingly infinite vulnerabilities.

dogma1138 2y ago

Freakazoid moment…

kps 2y ago

> … hacked my Sun 3/60 L1-A to bring up the boot monitor. Search memory for `/bin/login` and replace with `bin/ed`. Enter any file name as your ‘user’ name, or just junk, and use `!sh`. (Amazing what you remember from school…)

jeffs4271 2y ago
Glad to see vax and 68k sun guys of my vintage here still. The security game was different then. Miss the simple life. :-)

pixl97 2y ago

I remember using Novell netware in high school and if you random long lengths of passwords you could get the machine to crash. Didn't have any idea what was going on at the time. After highschool I saw an exploit for this where if you typed the right magic characters in you could highjack the execution of the login prompt and get a shell.

junon 2y ago
Novell was really bad at locking down machines lol. It was namely susceptible to the windows XP `at.exe cmd.exe` root shell bypass. Got in trouble a few times during school years doing that.

SoftTalker 2y ago

MacOS is descended from NeXTSTEP which dates back to the 1980s. There is probably a lot of terrible code in there. Edit: terrible from today's security perspective, I meant.

nmgycombinator 2y ago
Take a look at it yourself if you're curious. The kernel code is open source: https://github.com/apple-oss-distributions/xnu https://github.com/apple-oss-distributions/xnu

486sx33 2y ago

Certain DOCSIS cable modems … had a similar flaw “With many users now using modified config files to uncap their modems, most cable modem service providers acted to defeat this exploit by turning on the DOCSIS security feature that requires the CMTS to check the authenticity of the modem's config file during the registration process (this is explained in more detail in Chapter 9). As previously mentioned, this checksum is a HMAC-MD5 digest of the entire config file that uniquely iden- tifies its original contents, and it is constructed from the config file using a password chosen by the ISP. This defeats config file exploits because a user 8 Chapter 1| cannot create a checksum that would validate a modified config file without knowing the password that was used by the service provider when the original config file was created. Defeating the Message Integrity Check The fact that the systems of most ISPs had now been patched to prevent this type of uncapping was a challenge to be overcome. I began by attempting to hack the patch that the ISPs had implemented. My starting point was a phrase that was displayed in the modem's HTTP log page when the method described in the uncapping tutorial failed. The logs would read TFTP file complete-but failed Message Integrity check MIC. I wondered how I could bypass this message integrity check or MIC. One morning I awoke to frantic beeps coming from my computer; a member of my group was messaging me. He had the answer. The way to bypass the MIC was not to include the MIC! As simple as that might sound, I had no idea what he was talking about. He then sent me a copy of his config file and had me open it up in a basic hex editor (a program used to examine and modify binary files). The config file normally contained two different checksums at the end of the con- fig file: a standard MD5 checksum of the config, followed by another check- sum, the dreaded HMAC-MD5 (also known as the CmMic). He had simply trun- cated the config file, removing the HMAC-MD5 checksum and the two bytes before it (its header). Remarkably, this allowed any config to be used on any ISP. Once again, every ISP around the world was vulnerable to OneStep. NOTE This hack worked because the developers of the firmware used in the ISPs' routers, which process the config files and CMTS checksums sent from the modems, had not thoroughly tested the finished code. The basic config file processing function in the firmware would process operation codes (opcodes) that were present in the config file, including the CmMic opcode, and carry out the associated actions. But it would not check to confirm that the CmMic opcode had actually been sent (or even that the config file had success- fully authenticated). This flaw was severe because the ISP operators could not directly fix it in their routers; the only ones who could do so were the third-party vendors who supplied the firmware for the CMTSs. It would be a long time before the individual systems could be patched.”

spullara 2y ago

back in the 80s I got into a DEC system by doing roughly the same thing to an application running on VMS. basically you when it interrogated the terminal you could overflow it and drop into the command line.

dhosek 2y ago

I remember the first time I encountered a Windows machine you had to log in to to use (1996). At my first job, I had write access to all the system directories on the corporate VAX machine. I could have easily taken down a major corporation through a careless mistake (but fortunately, never did).

nine_k 2y ago

Back in the day, on my first day in a huge corporation famous for its refined engineering culture, I was issued a laptop that had some installation program running, to create a user for me, enroll on the corp network, etc. It had a bug, which made it run certain actions in an infinite loop. I pressed Ctrl+C, and got a root shell. From it, I ran the enrollment scripts I could find; it gave me sufficient access to pull from the corporate repo. So I took a ticket, found a related bug in the code, and created a patch fixing it on the first day, technically by cracking into a corporate laptop. (I had to wait for a properly completed enrollment to be able to push the code.)