Your favorite Apple, iPhone, iPad, iOS, Jailbreak, and Cydia site.
08-29-2013, 03:19 AM #1
Unpatched OS X Security Flaw Allows Users to Gain Root Access to Macs
An unaddressed bug in Apple’s Mac OS X discovered five months ago allows hackers to bypass the usual authentication measures by tweaking specific clock and user timestamp settings, granting near unlimited access to a computer’s files. While the security flaw has been around for roughly half a year, a new module created by developers of testing software Metasploit makes it easier to exploit the vulnerability in Macs, renewing interest in the issue according to ArsTechnica.
The bug revolves around a Unix program called sudo, which allows or disallows users operational access based on privilege levels. Top tier privileges grant access to files belonging to other users’ files though that level of control is password protected. Instead of putting in a password, the flaw works around authentication by setting a computer’s clock to Jan. 1, 1970 or what is referred to as the Unix epoch. Unix time starts at zero hours on this date and is the basis for calculations. By resetting a Mac’s clock, as well as the sudo user timestamp, to epoch, time restrictions and privilege limitations can be bypassed.
According to H.D. Moore, the founder of the open-source Metasploit and Chief Research Officer at security firm Rapid7:
The bug is significant because it allows any user-level compromise to become root, which in turn exposes things like clear-text passwords from Keychain and makes it possible for the intruder to install a permanent rootkit.
Although powerful, the bypass method has limitations. In order to implement changes, an attacker must already be logged into a Mac with administrator privileges and have run sudo at least once before. As pointed out by the National Vulnerability Database, the user trying to attempt to gain unauthorized privileges must also have physical or remote access to the target computer.
As of right now, Apple hasn’t responded or issued a patch for the bug. Moore said the following regarding the issue:
I believe Apple should take this more seriously but am not surprised with the slow response given their history of responding to vulnerabilities in the open source tools they package.
08-29-2013, 03:37 AM #2
If you have "Require an administrator password to access system-wide preferences" checked in Security & Privacy, it prevents you from changing the system clock (at least under 10.9). Not sure if this can be bypassed by a terminal command.
I just tested this using this post as the exploit command. You can't change time from Terminal if you do what I've mentioned and require a password to access system-wide prefs.
Last edited by WaLLy3K; 08-29-2013 at 03:47 AM.
The Following User Says Thank You to WaLLy3K For This Useful Post:
08-29-2013, 06:42 AM #3
You need physical or remote access... who would have guessed.
The Following User Says Thank You to LaddersRCool For This Useful Post:
08-29-2013, 08:55 AM #4
08-29-2013, 09:40 AM #5
08-29-2013, 09:55 AM #6
08-29-2013, 10:01 AM #7
08-29-2013, 11:20 AM #8
Having admin access isn't difficult if you have access to the machine unless single user mode is disabled. Boot into single user mode and just change the admin password and reboot and login as the admin or if you have an install disc handy change the admin password that way. Windows admin access can be had just as easily.
08-30-2013, 07:20 AM #9
08-30-2013, 08:30 PM #10
09-04-2013, 11:47 AM #11
Other flow - The FBI MoneyPak Virus Now Affects Mac OS X - her are recommendations on fixing the issue regarding the FBI Cyber Department MoneyPak virus for Mac OS X, as well as a description - source - How to remove FBI MoneyPak Virus on Mac OS X