Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.sys.mac.system > #72976 > unrolled thread

Hidden backdoor API to root privileges in Apple OS X

Back to article view | Back to comp.sys.mac.system

Contents

  Hidden backdoor API to root privileges in Apple OS X tmo1138 <tmo1138@tmo1138.org> - 2015-04-09 21:14 -0700
    Re: Hidden backdoor API to root privileges in Apple OS X Oregonian Haruspex <bob_davis_retired@yahoo.com> - 2015-04-09 23:29 -0700
    Re: Hidden backdoor API to root privileges in Apple OS X billy@MIX.COM - 2015-04-10 08:47 +0000
      Re: Hidden backdoor API to root privileges in Apple OS X dempson@actrix.gen.nz (David Empson) - 2015-04-19 18:05 +1200
        Re: Hidden backdoor API to root privileges in Apple OS X Tim Streater <timstreater@greenbee.net> - 2015-04-19 10:07 +0100
          Re: Hidden backdoor API to root privileges in Apple OS X Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-04-19 09:56 +0000
          Re: Hidden backdoor API to root privileges in Apple OS X dempson@actrix.gen.nz (David Empson) - 2015-04-19 22:02 +1200
            Re: Hidden backdoor API to root privileges in Apple OS X Tim Streater <timstreater@greenbee.net> - 2015-04-19 13:11 +0100
            Re: Hidden backdoor API to root privileges in Apple OS X Electric Comet <electric-comet@mail.invalid> - 2015-04-22 08:59 -0700
              Re: Hidden backdoor API to root privileges in Apple OS X Tim Streater <timstreater@greenbee.net> - 2015-04-22 17:33 +0100
                Re: Hidden backdoor API to root privileges in Apple OS X Electric Comet <electric-comet@mail.invalid> - 2015-04-22 09:40 -0700
              Re: Hidden backdoor API to root privileges in Apple OS X dempson@actrix.gen.nz (David Empson) - 2015-04-23 12:10 +1200
                Re: Hidden backdoor API to root privileges in Apple OS X Electric Comet <electric-comet@mail.invalid> - 2015-04-24 13:42 -0700
                  Re: Hidden backdoor API to root privileges in Apple OS X dempson@actrix.gen.nz (David Empson) - 2015-04-25 12:50 +1200
                    Re: Hidden backdoor API to root privileges in Apple OS X Electric Comet <electric-comet@mail.invalid> - 2015-04-27 09:36 -0700
    Re: Hidden backdoor API to root privileges in Apple OS X Electric Comet <electric-comet@mail.invalid> - 2015-04-22 09:01 -0700

#72976 — Hidden backdoor API to root privileges in Apple OS X

tl;dr

The Admin framework in Apple OS X contains a hidden backdoor API to 
root privileges. It’s been there for several years (at least since 
2011), I found it in October 2014 and it can be exploited to escalate 
privileges to root from any user account in the system.

<https://truesecdev.wordpress.com/2015/04/09/hidden-backdoor-api-to-root-privileges-in-apple-os-x/> 




-- 
The game of life is a game of boomerangs.  Our thoughts, deeds and words 
return to us sooner or later with astounding accuracy.

[toc] | [next] | [standalone]

#72980

On 2015-04-10 04:14:50 +0000, tmo1138 said:

> tl;dr
> 
> The Admin framework in Apple OS X contains a hidden backdoor API to 
> root privileges. It’s been there for several years (at least since 
> 2011), I found it in October 2014 and it can be exploited to escalate 
> privileges to root from any user account in the system.
> 
> <https://truesecdev.wordpress.com/2015/04/09/hidden-backdoor-api-to-root-privileges-in-apple-os-x/> 
> 

Ouch.  There's so much shit running at any one time in modern versions 
of OS X that it's no wonder something like this was lurking.  I have no 
doubt that there are lots more holes like this, mainly because once 
something works to a degree Apple seems to abandon further refinement 
in favor of cramming new features down our throats.

[toc] | [prev] | [next] | [standalone]

#72982

tmo1138 <tmo1138@tmo1138.org> quotes Emil Kvarnhammar:

> The Admin framework in Apple OS X contains a hidden backdoor API to 
> root privileges. It's been there for several years (at least since 
> 2011), I found it in October 2014 and it can be exploited to escalate 
> privileges to root from any user account in the system.

Now we know what's up with what was mentioned here last October.

OSX 10.10 hack - privilege escalation through rootpipe
https://www.youtube.com/watch?v=fCQg2I_pFDk

Billy Y..
-- 
        sub     #'9+1   ,r0             ; convert ascii byte
	add     #9.+1   ,r0             ; to an integer
	bcc     20$                     ; not a number

[toc] | [prev] | [next] | [standalone]

#73442

<billy@MIX.COM> wrote:

> tmo1138 <tmo1138@tmo1138.org> quotes Emil Kvarnhammar:
> 
> > The Admin framework in Apple OS X contains a hidden backdoor API to
> > root privileges. It's been there for several years (at least since 
> > 2011), I found it in October 2014 and it can be exploited to escalate
> > privileges to root from any user account in the system.
> 
> Now we know what's up with what was mentioned here last October.
> 
> OSX 10.10 hack - privilege escalation through rootpipe
> https://www.youtube.com/watch?v=fCQg2I_pFDk

Just in case anyone was thinking "I'm safe because I'm running an older
version of OS X":

- Apple has fixed this bug in OS X 10.10.3. Those still running Yosemite
10.10.2 or earlier are vulnerable.

- Apple has NOT fixed this bug in the corresponding security updates for
OS X 10.9.5 and 10.8.5, therefore Mavericks and Mountain Lion are still
vulnerable to this. Unknown yet whether Apple will change their mind and
do a security update to fix this on those systems (apparently it
requires substantial changes which would be complex to port back from
Yosemite to earlier systems).

- The researcher who published the bug said that it also affected
10.7.5, and I expect Apple won't fix it there, so Lion is permanently
vulnerable.

- The researcher wasn't able to test on 10.6, but in subsequent
discussion, another poster has come up with a variant of the exploit
demo code which works on 10.6.8 (which I've tested and confirmed),
therefore I expect Snow Leopard is also permanently vulnerable to this
issue.

I haven't tried the exploit code on 10.5 (Leopard) or earlier.

-- 
David Empson
dempson@actrix.gen.nz

[toc] | [prev] | [next] | [standalone]

#73448

In article <1m350iw.sordbl1dt7p98N%dempson@actrix.gen.nz>, David Empson
<dempson@actrix.gen.nz> wrote:

><billy@MIX.COM> wrote:
>
>> tmo1138 <tmo1138@tmo1138.org> quotes Emil Kvarnhammar:
>> 
>> > The Admin framework in Apple OS X contains a hidden backdoor API to
>> > root privileges. It's been there for several years (at least since 
>> > 2011), I found it in October 2014 and it can be exploited to escalate
>> > privileges to root from any user account in the system.
>> 
>> Now we know what's up with what was mentioned here last October.
>> 
>> OSX 10.10 hack - privilege escalation through rootpipe
>> https://www.youtube.com/watch?v=fCQg2I_pFDk
>
>Just in case anyone was thinking "I'm safe because I'm running an older
>version of OS X":
>
>- Apple has fixed this bug in OS X 10.10.3. Those still running Yosemite
>10.10.2 or earlier are vulnerable.
>
>- Apple has NOT fixed this bug in the corresponding security updates for
>OS X 10.9.5 and 10.8.5, therefore Mavericks and Mountain Lion are still
>vulnerable to this. Unknown yet whether Apple will change their mind and
>do a security update to fix this on those systems (apparently it
>requires substantial changes which would be complex to port back from
>Yosemite to earlier systems).

OK so here I am running an earlier OS version. How does some external
hacker exploit it on my machine?

-- 
"The idea that Bill Gates has appeared like a knight in shining armour to
 lead all customers out of a mire of technological chaos neatly ignores 
 the fact that it was he who, by peddling second-rate technology, led them
 into it in the first place."                             - Douglas Adams

[toc] | [prev] | [next] | [standalone]

#73450

In message <190420151007502138%timstreater@greenbee.net> 
  Tim Streater <timstreater@greenbee.net> wrote:
> In article <1m350iw.sordbl1dt7p98N%dempson@actrix.gen.nz>, David Empson
> <dempson@actrix.gen.nz> wrote:

>><billy@MIX.COM> wrote:
>>
>>> tmo1138 <tmo1138@tmo1138.org> quotes Emil Kvarnhammar:
>>> 
>>> > The Admin framework in Apple OS X contains a hidden backdoor API to
>>> > root privileges. It's been there for several years (at least since 
>>> > 2011), I found it in October 2014 and it can be exploited to escalate
>>> > privileges to root from any user account in the system.
>>> 
>>> Now we know what's up with what was mentioned here last October.
>>> 
>>> OSX 10.10 hack - privilege escalation through rootpipe
>>> https://www.youtube.com/watch?v=fCQg2I_pFDk
>>
>>Just in case anyone was thinking "I'm safe because I'm running an older
>>version of OS X":
>>
>>- Apple has fixed this bug in OS X 10.10.3. Those still running Yosemite
>>10.10.2 or earlier are vulnerable.
>>
>>- Apple has NOT fixed this bug in the corresponding security updates for
>>OS X 10.9.5 and 10.8.5, therefore Mavericks and Mountain Lion are still
>>vulnerable to this. Unknown yet whether Apple will change their mind and
>>do a security update to fix this on those systems (apparently it
>>requires substantial changes which would be complex to port back from
>>Yosemite to earlier systems).

> OK so here I am running an earlier OS version. How does some external
> hacker exploit it on my machine?

They don't. This flaw requires access to a local admin account.

-- 
Moving into the universe
And she's drifting this way and that
Not touching the ground at all
And she's up above the yard

[toc] | [prev] | [next] | [standalone]

#73451

Tim Streater <timstreater@greenbee.net> wrote:

> In article <1m350iw.sordbl1dt7p98N%dempson@actrix.gen.nz>, David Empson
> <dempson@actrix.gen.nz> wrote:
> 
> ><billy@MIX.COM> wrote:
> >
> >> tmo1138 <tmo1138@tmo1138.org> quotes Emil Kvarnhammar:
> >> 
> >> > The Admin framework in Apple OS X contains a hidden backdoor API to
> >> > root privileges. It's been there for several years (at least since
> >> > 2011), I found it in October 2014 and it can be exploited to escalate
> >> > privileges to root from any user account in the system.
> >> 
> >> Now we know what's up with what was mentioned here last October.
> >> 
> >> OSX 10.10 hack - privilege escalation through rootpipe
> >> https://www.youtube.com/watch?v=fCQg2I_pFDk
> >
> >Just in case anyone was thinking "I'm safe because I'm running an older
> >version of OS X":
> >
> >- Apple has fixed this bug in OS X 10.10.3. Those still running Yosemite
> >10.10.2 or earlier are vulnerable.
> >
> >- Apple has NOT fixed this bug in the corresponding security updates for
> >OS X 10.9.5 and 10.8.5, therefore Mavericks and Mountain Lion are still
> >vulnerable to this. Unknown yet whether Apple will change their mind and
> >do a security update to fix this on those systems (apparently it
> >requires substantial changes which would be complex to port back from
> >Yosemite to earlier systems).
> 
> OK so here I am running an earlier OS version. How does some external
> hacker exploit it on my machine?

This is apparently a local-only exploit, therefore it is more a case
that any future malware which _does_ manage to get onto your computer
(to the point where it can run arbitrary code outside of a sandbox) will
easily be able to get root access even if you are running as a non-admin
user.

Assuming the user is smart enough to avoid the usual phishing attacks,
malicious attachments, and software from dubious sources, the biggest
danger is likely to be compromised ad servers, which should be a low
risk as long as you run an up-to-date web browser (avoid Safari on Snow
Leopard or Lion), and avoid or protect against plugins like Flash, Java,
and other frequently compromised software.

The other option is to run a system so obscure that no malware
developers are interested, e.g. PowerPC Macs are probably safer than
Intel Macs.

-- 
David Empson
dempson@actrix.gen.nz

[toc] | [prev] | [next] | [standalone]

#73452

In article <1m35b2a.yhi55l1j64wjlN%dempson@actrix.gen.nz>, David Empson
<dempson@actrix.gen.nz> wrote:

>Tim Streater <timstreater@greenbee.net> wrote:
>
>> In article <1m350iw.sordbl1dt7p98N%dempson@actrix.gen.nz>, David Empson
>> <dempson@actrix.gen.nz> wrote:
>> 
>> ><billy@MIX.COM> wrote:
>> >
>> >> tmo1138 <tmo1138@tmo1138.org> quotes Emil Kvarnhammar:
>> >> 
>> >> > The Admin framework in Apple OS X contains a hidden backdoor API to
>> >> > root privileges. It's been there for several years (at least since
>> >> > 2011), I found it in October 2014 and it can be exploited to escalate
>> >> > privileges to root from any user account in the system.
>> >> 
>> >> Now we know what's up with what was mentioned here last October.
>> >> 
>> >> OSX 10.10 hack - privilege escalation through rootpipe
>> >> https://www.youtube.com/watch?v=fCQg2I_pFDk
>> >
>> >Just in case anyone was thinking "I'm safe because I'm running an older
>> >version of OS X":
>> >
>> >- Apple has fixed this bug in OS X 10.10.3. Those still running Yosemite
>> >10.10.2 or earlier are vulnerable.
>> >
>> >- Apple has NOT fixed this bug in the corresponding security updates for
>> >OS X 10.9.5 and 10.8.5, therefore Mavericks and Mountain Lion are still
>> >vulnerable to this. Unknown yet whether Apple will change their mind and
>> >do a security update to fix this on those systems (apparently it
>> >requires substantial changes which would be complex to port back from
>> >Yosemite to earlier systems).
>> 
>> OK so here I am running an earlier OS version. How does some external
>> hacker exploit it on my machine?
>
>This is apparently a local-only exploit, therefore it is more a case
>that any future malware which _does_ manage to get onto your computer
>(to the point where it can run arbitrary code outside of a sandbox) will
>easily be able to get root access even if you are running as a non-admin
>user.
>
>Assuming the user is smart enough to avoid the usual phishing attacks,
>malicious attachments, and software from dubious sources, the biggest
>danger is likely to be compromised ad servers, which should be a low
>risk as long as you run an up-to-date web browser (avoid Safari on Snow
>Leopard or Lion), and avoid or protect against plugins like Flash, Java,
>and other frequently compromised software.

Ah. Right. Thanks, I suspected that was the situation but much
appreciate having it made explicit.

-- 
"People don't buy Microsoft for quality, they buy it for compatibility
with what Bob in accounting bought last year. Trace it back - they buy
Microsoft because the IBM Selectric didn't suck much" - P Seebach, afc

[toc] | [prev] | [next] | [standalone]

#73877

On Sun, 19 Apr 2015 22:02:36 +1200
dempson@actrix.gen.nz (David Empson) wrote:

> This is apparently a local-only exploit, therefore it is more a case

you say local-only then go on to say "well it's remote if you're not
careful"

that means it's exploitable remotely

> Assuming the user is smart enough to avoid the usual phishing attacks,

i think many people here including you have a serious disdain for the
users

but really it's a disease for most developers/programmers too

i guess it's easier to blame the user than do the heavy, heavy
lifting to make computers easy to use


> malicious attachments, and software from dubious sources, the biggest
> danger is likely to be compromised ad servers, which should be a low
> risk as long as you run an up-to-date web browser (avoid Safari on
> Snow Leopard or Lion), and avoid or protect against plugins like
> Flash, Java, and other frequently compromised software.

add to that javascript,css, etc.

> 
> The other option is to run a system so obscure that no malware
> developers are interested, e.g. PowerPC Macs are probably safer than
> Intel Macs.

or don't use a computer


















 

[toc] | [prev] | [next] | [standalone]

#73886

In article <mh8gj6$2n7$3@dont-email.me>, Electric Comet
<electric-comet@mail.invalid> wrote:

>On Sun, 19 Apr 2015 22:02:36 +1200
>dempson@actrix.gen.nz (David Empson) wrote:

>> malicious attachments, and software from dubious sources, the biggest
>> danger is likely to be compromised ad servers, which should be a low
>> risk as long as you run an up-to-date web browser (avoid Safari on
>> Snow Leopard or Lion), and avoid or protect against plugins like
>> Flash, Java, and other frequently compromised software.
>
>add to that javascript,css, etc.

Perhaps you'd enlighten us as to how either of these is a problem.

>
>
>
>
>
>
>
>
>
> [this space deliberatly left blank]
>
>
>
>
>
>
>
>
> 
>

-- 
"That excessive bail ought not to be required, nor excessive fines imposed,
nor cruel and unusual punishments inflicted"  --  Bill of Rights 1689

[toc] | [prev] | [next] | [standalone]

#73887

On Wed, 22 Apr 2015 17:33:45 +0100
Tim Streater <timstreater@greenbee.net> wrote:
 
> Perhaps you'd enlighten us as to how either of these is a problem.

you can certainly just go browse the web
don't discriminate and make sure you have everything enabled

no ad blocks
no pop-up blocks
don't inhibit javascript at all
some browsers allow you to restrict javascript

make sure to visit some sites that will test your browser when
you visit 

search exploits
vulnerabilities
frameworks
css
portscanner


do a good backup and put it offline first though

good luck & far ewell










 

[toc] | [prev] | [next] | [standalone]

#73956

Electric Comet <electric-comet@mail.invalid> wrote:

> On Sun, 19 Apr 2015 22:02:36 +1200
> dempson@actrix.gen.nz (David Empson) wrote:
> 
> > This is apparently a local-only exploit, therefore it is more a case
> 
> you say local-only then go on to say "well it's remote if you're not
> careful"
> 
> that means it's exploitable remotely

No, I didn't say that. This issue alone isn't exploitable remotely. 

Malcious software would need some other vulnerability to attack the
computer remotely, or a trojan horse or similar to trick the user into
running it (at which point it is running locally, and this exploit is
applicable).

> > Assuming the user is smart enough to avoid the usual phishing attacks,
> 
> i think many people here including you have a serious disdain for the
> users

I certainly don't have a disdain for users. I'm frequently helping them.

That was more of a sad comment on the reality of the situation - too
many people have been tricked into opening malcious attachments, or
downloading executable code from fake web sites, or believing scam
callers claiming their computers are infected and asking for remote
control.

I can only hope that if that does happen to someone, the damage is not
serious, they learn from the experience, and are more careful in future.

> but really it's a disease for most developers/programmers too
> 
> i guess it's easier to blame the user than do the heavy, heavy
> lifting to make computers easy to use

Nobody seems to achieved that yet, without sacrificing all external
connectivity.

> > malicious attachments, and software from dubious sources, the biggest
> > danger is likely to be compromised ad servers, which should be a low
> > risk as long as you run an up-to-date web browser (avoid Safari on
> > Snow Leopard or Lion), and avoid or protect against plugins like
> > Flash, Java, and other frequently compromised software.
> 
> add to that javascript,css, etc.

Turning those off makes too many web sites unusable. Keeping your web
browser up to date should minimise the risk of those as potential attack
vectors. In any case, they are nowhere near as dangerous as an outdated
version of Flash or Java as a web plugin.

-- 
David Empson
dempson@actrix.gen.nz

[toc] | [prev] | [next] | [standalone]

#74008

On Thu, 23 Apr 2015 12:10:19 +1200
dempson@actrix.gen.nz (David Empson) wrote:

> Malcious software would need some other vulnerability to attack the
> computer remotely, or a trojan horse or similar to trick the user into
> running it (at which point it is running locally, and this exploit is
> applicable).

the key unlocks the door but the door's not open because you didn't
turn the knob

> I certainly don't have a disdain for users. I'm frequently helping
> them.

you said if the user's not smart enough
the user is at the mercy of the hardware/software
how smart does the user need to be
the programmer is not smart enough and they should remind themselves
constantly

the user disdain runs deep
but call them not smart enough if that suits you

> That was more of a sad comment on the reality of the situation - too
> many people have been tricked into opening malcious attachments, or
> downloading executable code from fake web sites, or believing scam
> callers claiming their computers are infected and asking for remote
> control.

taking advantage of people's good will is wrong
users are enticed and they don't know better
sure it helps to educate but really the current reality is that
software and OSs especially need to be rethought and redone

> I can only hope that if that does happen to someone, the damage is not
> serious, they learn from the experience, and are more careful in
> future.

hope's no good and is a bad habit
being careful presumes knowledge and discernment
that's hard with computers due to complexity and the fact that it's
hard to tell good from bad

not like if you go into a sketchy downtown where you know quickly

> Nobody seems to achieved that yet, without sacrificing all external
> connectivity.

the right "nobody" hasn't care enough

> Turning those off makes too many web sites unusable. Keeping your web
> browser up to date should minimise the risk of those as potential
> attack vectors. In any case, they are nowhere near as dangerous as an
> outdated version of Flash or Java as a web plugin.

it should but doesn't
how many times has flash updated in the past 6 mos. and why does
it even still exist

sad indeed and no blame on the user










 

[toc] | [prev] | [next] | [standalone]

#74014

Electric Comet <electric-comet@mail.invalid> wrote:

> On Thu, 23 Apr 2015 12:10:19 +1200
> dempson@actrix.gen.nz (David Empson) wrote:
> 
> > Malcious software would need some other vulnerability to attack the
> > computer remotely, or a trojan horse or similar to trick the user into
> > running it (at which point it is running locally, and this exploit is
> > applicable).
> 
> the key unlocks the door but the door's not open because you didn't
> turn the knob

Wrong analogy. The key doesn't unlock the door to the house. You have to
let them into the house before they can do anything.

The key unlocks a secure room inside the house, but they have to get
through the outer door first.

-- 
David Empson
dempson@actrix.gen.nz

[toc] | [prev] | [next] | [standalone]

#74343

On Sat, 25 Apr 2015 12:50:33 +1200
dempson@actrix.gen.nz (David Empson) wrote:

> The key unlocks a secure room inside the house, but they have to get
> through the outer door first.

they visited a site and the site was ready & waitin
got compromised
voila

no analogies no big leaps of imagination required

not the users fault it is the OS fault and the programmers of the
OS and all the people behind the OS, etc., etc., etc.

it's all sleight of hand to talk about security
it's bugs and bad designs and poor decisions

linux is old*
macosx is old*
windows is old*
?bsd is old*

time for a new OS


*in the compute world they are ancient

 









 

[toc] | [prev] | [next] | [standalone]

#73879

On Thu, 9 Apr 2015 21:14:50 -0700
tmo1138 <tmo1138@tmo1138.org> wrote:

> The Admin framework in Apple OS X contains a hidden backdoor API to 

how to check for compromise

are there scripts to do that











 

[toc] | [prev] | [standalone]

Back to top | Article view | comp.sys.mac.system

csiph-web