48 ms·
Hidden backdoor API to root privileges in Apple OS X
- deleted 12y ago[deleted]
- percept 12y agoRelated to this, how have people found running Yosemite compared to Mavericks, performance and compatibility-wise? Are you sorry you upgraded? (I'm asking for a friend.)
- Osiris 12y agoI upgraded. I haven't had any problems that I wasn't already having in Mavericks (Anyone else have kernel panics when sleeping with a thunderbolt monitor attached?).
- Sevrene 12y agoYes! (although minus the thunderbolt monitor)
- Osiris 12y agoI also have a problem with a Dual-link DVI adapter. If I sleep with it connected, at some point it wakes up and "kernel_task" takes up 100% CPU (all 8 cores) until I put it to sleep and wake it up again. Sucks coming down in the morning and finding my Macbook burning a hole in the desk.
- NathanKP 12y agoI haven't had any issues with that, and I have two thunderbolt monitors attached in daisy chain mode. The only kernel panics I've experienced so far have been Parallels Desktop bugs that crashed the system. I'm regularly stressing my Macbook Pro to the max running vagrant images through Parallel Desktop with full integration tests running inside, and this tends to be pretty effective at finding strange bugs in Parallels Desktop.
- mrchucklepants 12y agoI've been running with a Thunderbolt Display for a few years now with few problems. I've had zero problems on Yosemite.
- jug 12y agoAmong other things upgrading (to 10.10.3) will do, it'll fix the issue in the article.
- Alex3917 12y agoMy personal computer is a late 2008 MBP, and Yosemite runs fine on that. It's been upgraded to 8 gigs of ram, and that's enough to smoothly do dev work in vagrant environments.
- fmela 12y agoI have the exact same setup with 8GB of RAM, and it's still going strong. I wish I could upgrade to 16GB to extend its life even further.
- deleted 12y ago[deleted]
- nmc 12y agoWell, you have a reason now, have you not?
- deleted 12y ago[deleted]
- cheald 12y agoCan you provide more info? FTA: "OS X 10.9.x and older remain vulnerable, since Apple decided not to patch these versions."
- 3JPLW 12y agoYes, but that security update doesn't include this patch. Apple confusingly lists the security updates in 10.10.3 and Security Update 2015-004 together, but not all items apply to 10.9. The very first item listed on the page is this Admin Framework bug, and it's only available for v10.10 to v10.10.2. https://support.apple.com/en-us/HT204659 https://support.apple.com/en-us/HT204659
- plorkyeran 12y agoXcode 6.3 is out now and requires 10.10. I also waited as long as I could, so now I have a machine that's been installing Yosemite for the last 18 hours...
- shepard 12y agoIt's a known issue related to having many nonstandard files in /usr/local or something like that. Eg. If you are using brew. Google for it, or just wait patiently, it should finish at some point.
- btgeekboy 12y agoIf you're seriously concerned, why not use an external drive of some sort and install Yosemite to it? (Bonus points: clone your internal disk to it first, and upgrade that.) Boot it up, test out your critical functions, and then update your main volume if it works out for you.
- Nexxxeh 12y agoWould using an external drive make it noticeably slower, making performance non-representative?
- JustSomeNobody 12y agoNot if you get one of these: http://www.amazon.com/Samsung-Portable-250GB-External-MU-PS250B/dp/B00RWXV8FE/ref=sr_1_1?ie=UTF8&qid=1428596708&sr=8-1&keywords=samsung+external+ssd http://www.amazon.com/Samsung-Portable-250GB-External-MU-PS2...
- tlrobinson 12y agoThat would depend on which interface and drive technologies you use. A SSD connected via Thunderbolt would likely be faster than an internal hard drive.
- quicklyfrozen 12y agoThis + SSD (Crucial IIRC) gives me 200+Mb/s write, 400+Mb/s read speeds: http://amzn.com/B00FCLG65U http://amzn.com/B00FCLG65U USB 3.0 is pretty fast. Without TRIM performance will probably degrade but that will take time.
- markcerqueira 12y agoYou need to do the Bonus points version of your recommendation. Running an OS off an external will just make everything feel sluggish (unless you have a lightning enclosure and spare SSD laying around).
- lultimouomo 12y agoI recently got a mac mini that shipped with Yosemite. It has the nice feature of completely killing the WiFi interface when you attach a USB hub - googling around it seems a Yosemite bug. I have been told that also using bluetooth devices (such as the apple mouse) can trigger the same behaviour. So I'd say I'm sorry that the mac shipped with Yosemite, except that at least I received the fix for the privilege escalation bug.
- marcinx27 12y agoI had this bug plaguing me for a while. My WiFi connection would drop every fifteen minutes or so, requiring me to turn off the WiFi and then turn it on again. I was able to fix it by doing a clean install of Yosemite (from a bootable drive).
- julian_t 12y agoIt isn't just Yosemite... I had exactly this behavior with Mavericks on a new MacBook last year. Fired up a Bluetooth mouse, and next time I opened the lid wireless had completely gone. I've managed to get it working after a fashion, although not reliably, and have come to the conclusion that Apple just don't do wireless well.
- pquerna 12y agoTitle is a little generous about "hidden", the exploit revolves around API & Framework used to power the parts of the control panel, and its authorization scheme being broken. I do think its too bad that setuid binaries don't have additional restrictions, like 100% must be code-signed or must be run in a sandbox-exec[1] based on that signing. [1] - https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man7/sandbox.7.html#//apple_ref/doc/man/7/sandbox https://developer.apple.com/library/mac/documentation/Darwin...
- smackfu 12y agoIsn't the "hidden" part related to them being a private API/Framework?
- AnthonyMouse 12y agoCode signing is not interesting. If normal people can get their code signed then so can the attacker and if they can't then it locks you out of your own computer. The only thing code signing is really good for is to verify that an update to a program the machine's owner installed was signed by the same author as the original program, and unfortunately it's rarely implemented that way. But that's not really what you're asking for anyway. You can assign granular permissions to binaries regardless of code signing. The real problem is there are so many things that aren't literally root but are effectively equivalent because if you can do them then you have easy privilege escalation. That's why the Windows security model is so silly. An administrator is not allowed to 'su' to another user without the user's password but any reasonable subset of the administrator's privileges can be used to silently cause any user to execute arbitrary code, e.g. by setting their login script or putting executables in the All Users startup folder or just loading a kernel driver that will let them do whatever they want.
- superuser2 12y ago>then so can the attacker Maybe, but the attacker can also get their certificate revoked when their activities are discovered.
- moey 12y agoWith physical access, one has been able to create admin accounts for as long as I can remember. - Start up the Mac whilst holding down ⌘-S. This boots the Mac into Single-User Mode and provides a method of interacting with OS X via the command-line, with full root privileges. - Then check the filesystem to ensure there are no problems: "/sbin/fsck -fy" - Then mount the filesystem for it to be accessible: "/sbin/mount -uw /" - Now remove this file so OS X will re-run Setup Assistant: "rm /var/db/.AppleSetupDone" Now just restart, and enjoy the cool introduction animation as you create your admin account.
- taumhn 12y agoIf you're paranoid enough to think someone you don't trust can have physical access to your Mac, it is possible to prevent this by setting up firmware password though. See https://support.apple.com/en-us/HT204455 https://support.apple.com/en-us/HT204455
- thudson 12y agoFirmware passwords can be bypassed by a local user with a Thunderbolt Option ROM. The 10.10.2 fix for Thunderstrike left that hole open during normal boots: https://trmm.net/Thunderstrike_FAQ#Is_Thunderstrike_fixed_in_10.10.2.3F https://trmm.net/Thunderstrike_FAQ#Is_Thunderstrike_fixed_in...
- KuchenKerze 12y agoNot possible if full disk encryption is enabled. And that is a default since a year or so.
- nothrabannosir 12y agofull disk encryption only protects you from passive snooping. If someone has physical access between two of your subsequent uses, no amount of any type of encryption will save you. Except maybe some entangled quantum bit collapsing mechanism. Maybe. Think hardware keyloggers, fake MBRs, &c. OP's trick won't work, but that's an "implementation detail;" there are plenty others that will. EDIT: to clarify; that's not what you said, it's just a common enough misconception that it's worth being explicit about, here.
- diminoten 12y ago> Apple indicated that this issue required a substantial amount of changes on their side, and that they will not back port the fix to 10.9.x and older. What? So all OS X boxes are simply broken, privileges-wise, if they're not on 10.10?
- danielweber 12y agoApple's model customer is one who upgrades often. If you want solid support for old products, stick with Microsoft, and accept that their products can be clunkier because of deliberate choices to maintain backwards-compatibility.
- e40 12y agoWhat about developers that need to support customers on older systems?
- ryanlol 12y agoMany don't.
- plorkyeran 12y agoYou basically need VMs for every version of OS X you want to support, and need to keep copies of the old OS X SDKs since Apple seems not to test that newer ones will continue to work despite superficially supporting choosing a target version. Most developers don't bother, as Apple has successfully made it quite difficult.
- matt4077 12y agoTo be fair, OS X updates are free and usually run well even on 5+ years old hardware. OS X has kinda gone the way of Chrome, with most users on the newest version.
- toong 12y agoThey are now. I remember buying upgrades ?
- raldi 12y agoI'm having a hard time understanding whether this is an intentional backdoor or just an accident.
- coldpie 12y agoSmells like an oversight to me. Some new developer got assigned to implement or tweak the SSH enabling switch (or whatever), and this was their solution, which never got reviewed.
- raldi 12y agoIn that case, I think "backdoor" is hyperbolic. That word is usually uses to indicate intentional secret security holes.
- coldpie 12y agoI guess. It's a backdoor in the sense that you can intentionally bypass privilege checks by calling a certain API with a particular argument. But I don't think it's a backdoor in the sense that the developers wanted a secret way to gain root on an arbitrary machine.
- navait 12y agoWorked wonders for getting to the top of HN though.
- mikeash 12y agoWhat do you call something that grants root access without authentication, but wasn't intended to let arbitrary people or programs use it? "Backdoor" isn't quite right, since that implies that the intent was to allow unauthorized use. "Security vulnerability" isn't quite right either, since that usually implies getting code to exhibit some sort of behavior it was never supposed to have. I can't think of any other term. Of the two, "backdoor" seems closer. Maybe "unintentional backdoor"?
- uxp 12y ago
- towelguy 12y ago> Okay, so the systemsetup binary simply checks if we are running as the root user? >Philip tried patching that function (replacing sete with setne), with success: How do you patch the binary without root or the admin user password anyway?
- nmc 12y agoI think this is not part of the exploit, it was simply a step to ensure that their intuition about the assembly code was correct. Hint: the first sentence you quoted ends with a question mark.
- apendleton 12y agoPretty sure they did that as root, so they could get past that and explore how the program worked when being run as a non-root user. The final exploit doesn't depend on this program, though; it uses the same RPC interfaces this program does, from a separate program, so the patching was just part of their exploration, not part of the exploit.
- AgentME 12y agoJust make a copy of the binary that's editable by the user. Or copy its code into a new program. There's nothing special about the specific root-owned systemsetup binary. (It's not setuid.)
- Nexxxeh 12y agoAre Apple glad it wasn't found by a "You have 90 days before disclosure" outfit? Look at that timeline...
- 72deluxe 12y agoPretty lengthy time! Let's hope he got a bounty or a free device as a reward
- __m 12y agowait, you expected to find people at a security conference that weren't aware of the fact that even OS X can have exploitable vulnerabilities?
- driverdan 12y agoSix months for a fix? I would have given them 90 days and released it.
- mike_hearn 12y agoObjective-C's "null pointer dereferences doesn't crash" behaviour rears its ugly horrible head again. Programs crash for a reason! Crashing when faced with nonsense is a good thing! Let us not forget this.
- kaoD 12y agoCan you explain this to non Obj-C users? How does it not crash on null pointers?
- pcwalton 12y agoCalling any method ("sending any message" in Objective-C terminology) on a nil receiver does nothing and returns the zero value of the method's result type (a value of the right size with all bits zeroed).
- swolchok 12y agoThe Obj-C function call [foo doSomething] compiles to the equivalent of objc_msgSend(foo, "doSomething"); (for the pedantic, I'm intentionally simplifying and leaving out objc_selfrefs) The first thing objc_msgSend does is check if foo is nil and, if so, returns 0/nil/the all-zero bit pattern/whatever. It can be extremely convenient, but it can also be extremely inconvenient.
- 72deluxe 12y agoVery informative, thanks. I am a C++ developer and recently had to fix a bug in an OSX app using Obj-C, which looks insane syntax to me. This only goes to reaffirm my belief that it's insane. Anyway, I'll carry on reading my ObjC book as obviously the language has uses, although there's a Swift book in the post. Which do I read first though, eh?
- bitwize 12y agoIn Objective-C 'nil' is a special object (internally rwpresented by a null pointer). When the runtime is instructed to invoke any method on nil, the method does nothing and returns nil (rather than crashing). I think this is an artifact of Smalltalk behavior.
- po1nter 12y agoOT but I have to say that the amount of Apple apologists in these comments is mind blowing. HN reader of all people should be the ones urging Apple to issue a fix for a very serious bug such as this one. Yet many comments here are saying that people should just upgrade while it might solve the problem for some, there are ones who can't upgrade machines at will.
- thebouv 12y agoSame devs who just say "users should just upgrade their browsers" perhaps? If only it were that easy. Yosemite just seems to "break" some things and I've still been waiting it out.
- bougiefever 12y agoHey, at least there weren't any of the 'Well, I don't care if anyone sees all my boring details anyway' variety. At least people are beginning to understand the most basic implications of loss of privacy.
- rdudek 12y agoI have to agree. I have an older macbook that if I upgrade to another above Snow Leopard, it runs pretty slow. But I do understand that support for older devices has to stop at some point.
- graeme 12y agoYeah, this is scandalous. I've heard enough things about Yosemite bugs that I held off upgrading, especially as I want to avoid software compatibility issues. I hate Apple's new yearly release cycle. There's not enough time to stabilize and improve OS's. This update just rolled out, but it indicates the admin fixes are only for Yosemite: https://support.apple.com/en-us/HT204659 https://support.apple.com/en-us/HT204659 How worried should I be about not having updated? There's still a risk I may lose some program compatibility by updating.
- kentonv 12y agoIs your mac a server or a multi-user desktop where some users intentionally don't have admin access? If so, you're in trouble. If not, this bug probably doesn't really matter to you. For a single-user desktop machine, realistically, user/root privilege separation doesn't matter, because all your important data is in your home directory and not protected by root privileges anyhow. The root-protected stuff is actually the stuff that's easiest to replace, because it's just a bunch of software that you can re-install. Viruses don't need to infect your software to stay resident; they can just as easily register a login hook without root permissions. (That said, some people will violently disagree with me on this.)
- jrochkind1 12y agoI am really pissed they are only releasing a patch for 10.10, and forcing me to upgrade to 10.10.
- mxfh 12y agoSo is Snow Leopard (Mac OS X 10.6.8) not affected?
- antimora 12y agoThis article has a nice exploit code written in python down below for curious ones how works in code.
- pbreit 12y agoCould anyone summarize the implications of this finding in plain English?
- kalleboo 12y agoAny code running as any user on an unpatched version can become root (and do whatever it wants, E.g. install keyloggers) Sandboxed apps (from the app storr) may be blocked from doing this, I'm not sure.
- kybernetyk 12y ago>Sandboxed apps (from the app storr) may be blocked from doing this, I'm not sure. Just tried. Sandbox lets this through. (As long as you pass nil to authenticateUsingAuthorizationSync:).
- 72deluxe 12y agoOuch.
- maqr 12y agoSometimes these things are easier to explain if you look at it like an attacker: If you're a regular user of an OSX system before 10.10.3, and you want to become root (admin user), you can use this exploit to become root. If you're an author of malicious OSX software, and a user without admin permissions installs your malware, you can use this exploit to make your malware run as root. Once you have root, you can do anything on a system. If the system you're attacking is 10.10.3 or later, you won't be able to use this exploit because Apple has a fix in 10.10.3. Apple will not make the fix available to anyone on 10.9 or earlier.
- jjarmoc 12y agoWhile this is a significant vulnerability, I don't think the article is correct when it calls it a 'backdoor.' The term backdoor typically implies something that was intentionally left to allow illicit access, and while this is a significant bug, I don't see anything to indicate that's the case here.
- f3llowtraveler 12y agoThere's no way to tell for sure if something like this is intentional or not. Also, waiting to fix it until a researcher makes it public may have been intentional.
- jjarmoc 12y ago> There's no way to tell for sure if something like this is intentional or not. Right, so the simplest explanation is that it's an unintentional bug. The absence of evidence that it was unintentional isn't evidence that it was intentional. If there were some magic string or default password or something, that'd be an obvious backdoor, but to me this looks like a pretty typical privesc bug, albeit in an undocumented api. It was found through a chain of events that started with looking at the patch related to another privilege escalation vulnerability, one which no one seems to be claiming was a backdoor. > Also, waiting to fix it until a researcher makes it public may have been intentional. I'm guessing it's more likely the the researcher waiting to go public until it was fixed. This is evidenced both by the fact that it was patched alongside other vulns (ie. not a rushed out one-off patch) and from the article's disclosure timeline, which shows 'Full disclosure' occurring 04/09, while the 'Release of OS X 10.10.3' occurred 04/08. This is a pretty typical disclosure timeline; they couldn't begin to fix it until it was tracked as a bug, after all.
- Animats 12y agoThere's no way to tell for sure if something like this is intentional or not. Yes, there is. Sue Apple for willful negligence and subpoena the development logs.
- anonbanker 12y agoso... Anyone preparing OpenBSD to work on newer macbooks?
- bdcravens 12y ago10.10.3 came out 2 days ago. This counts as reasonable disclosure?
- cozzyd 12y agoHe discovered it 6 months ago. Maybe he gave Apple 6 months to fix it before disclosing?
- bdcravens 12y agoI get that, but surely you have to provide a reasonable amount of time for patches to be installed. Perhaps a 2-part blog entry, where he gives general details (to instill urgency) and then release exploit code a month later?
- cozzyd 12y agoIf he published because Apple just patched, then I agree. If he published because he said he was going to disclose it at a certain time, then I think it's Apple's fault for dragging their feet. 6 months is an eternity.
- smackfu 12y agoOnce the fix is out there, attackers can compare the new and old code and home in on the vulnerability very quickly.
- ccvannorman 12y agoAs someone who loathes Yosemite, I was hoping to find another fix for this. However, the exploit code when run in my console already returns "You need an administrator password" prompt. Huh? I'm running 10.9.5.
- super_mario 12y agoRun the python script at the end of the article as non admin/non root user. The script allows you to create a copy of a binary in say /usr/bin with "set user ID execution" bit set and owned by root! This should not be possible without root privileges. This is pretty bad, and trivially exploitable. Basically anyone that has non-root access to your computer can trivially become root and take over the system.
- devy 12y agoWhen Apple refuses to fix something that's good the public's interest, the best way to get Apple's attention is to make this a rootpipe gate by sending tips to all Apple focused media outlets like AppleInsider Macrumors etc. Talk about the power of press. Case in point: Antenna gate, Bend-gate etc.
- floatboth 12y agoOf course this exploits XPC. I really hate all the desktop IPC bullshit. IPC frameworks are pure fucking evil. COM, D-Bus, XPC, everything SUCKS. If you want completely separate programs on one machine to talk, use UNIX domain sockets (with something like ZeroMQ or HTTP), FIFOs (named pipes), anything that you can chmod and chown, not a daemon that reinvents access control, badly.
- deleted 12y ago[deleted]
- catern 12y agoWell, this is a very trivial "exploit" of XPC. The real problem is that such an API even exists at all. I mean, a method to create an arbitrary file in an arbitrary location with arbitrary attributes? That is completely braindead. That is clearly equivalent to root privileges, and therefore such an API shouldn't exist - sudo should be used instead, or other OS X methods of explicitly gaining root privileges. This method wouldn't pass the most cursory of security checks. It's clear that it was never actually reviewed, and that the original programmer was relying on the proprietary nature of the OS X system for security. Something like this would never happen with Linux IPC - reviewing the methods published on dbus by services running as root by default is a basic check that any sane distro will do. Something as straightforwardly exploitable as this (literally just call the method while running as an admin user!) would never go in to Debian.
- kenferry 12y agoHm? This wouldn't have been any better if implemented using sockets.
- FooBarWidget 12y agoIndeed, it wouldn't. It's just another typical example of someone who doesn't understand why a complicated IPC system exists, and thus blames all possible problems on its mere existence. It's like users who encounter a random problem in a program, and then blame it on the fact that the program is written in C++, simply because they do not like C++.
- hellbanner 12y agoOT but does anyone know how OSX bluetooth keyboards work? I thought I had BT disabled and a prompt popped up on hotel wi-fi asking me to enter the code for (not my) keyboard
- sounds 12y agoSo who wants to sell a patch for the now unsupported users of OS X 10.9, 10.8, ...? It could be as simple as changing the permissions on System Preferences so that now you must enter your password before running them (so that they always run as root). Then patch out the backdoor.
- yourad_io 12y ago> The Admin framework in Apple OS X contained a hidden backdoor API to root access for several years (at least since 2011, when 10.7 was released). Lion was cancer.
- yourad_io 12y agoI see there's no love for Zodiac puns. Oh well, I still love you guys.
- T3RMINATED 12y agowhat was the bug bounty?
- cmurf 12y agoIt does explicitly say that Security Update 2015-004 only updates Admin Framework on 10.10+ (it does not require 10.10.3) to fix CVE-2015-1130 : Emil Kvarnhammar at TrueSec https://support.apple.com/en-us/HT204659 https://support.apple.com/en-us/HT204659 Quite a few other security related things are fixed with this update that do apply to older versions of OS X.
- ddp 12y agoI also don't think this indicates malicious intent. It's as likely that some collection of junior engineers who were tasked with something other than system security, simply invented something that was both insecure and obscure. This happens all the time. It takes a lot of extra time and code to engineer security and it's historically been one of the first things that product managers and senior management will toss out the door when the schedule inevitably becomes the gating factor. Hey, they fixed it. And you know, some Day One bugs are simply very very hard to fix when you find out years later that there's all this other code that depends on it...
- yuhong 12y agoI wonder how long before malware that uses this will appear, given this is trivial to exploit.
- thrownaway2424 12y agoCouldn't they have made the update slightly smaller than 2GB? Apple sucks at distribution and their software update infrastructure is hosing.
- williamstein 12y agoI upgraded my 2014 15" rMBP and it killed the wifi, so now ping times have gone from about 12ms to several thousand or nothing. https://medium.com/@mariociabarra/wifried-ios-8-wifi-performance-issues-3029a164ce94 https://medium.com/@mariociabarra/wifried-ios-8-wifi-perform... no longer works. Depressing. I miss my chromebook.
- arbitrage 12y agoYou could sell your rMBP and use the proceeds to buy like 4-5 chromebooks.
- 72deluxe 12y agohttps://support.apple.com/en-us/HT204659 https://support.apple.com/en-us/HT204659 makes for depressing reading. Impact: A local user may be able to cause a system denial of service Impact: A local user may be able to cause unexpected system shutdown These two made me laugh though.
- deleted 12y ago[deleted]