Slashdot Mirror
Screensaver Bug in Mac OS X
dave1212 writes "Still too early to tell, but there seems to be a screen saver password exploit in Mac OS X. It was discovered and postedon the Full Disclosure list earlier today. Theories, personal tests, and rumours abound, with some success stories, and the possibility that it could affect all Cocoa programs. Speculation points toward a 2048 character buffer, with people using the emacs shortcuts Ctrl-K and Ctrl-Y to fill the text field in under half a minute."
Is it always buffer overflows? :/
Someone identify the Final Cut Pro box cutting Return of the King and swipe the rough cut!
Okay now...Apple is swiftly closing the gap with Microsoft in the amount of holes it has.
I was the one that posted about the address bar in Safari. I am using 10.2.6. This is a problem for ALL cocoa apps.
It'll probably be trivial for Apple to fix, though. So I'm just waiting for the patch to arrive.
*taps finger on desk*
A full, easily exploitable security hole in MacOS X. Now all those windoids will have no reason not to switch, as MacOS X now provides all the features of Windows, including a security hole.
I have no tag line
using 10.2.6 - not saying it's not a real bug, just can't get it to crash my screen-saver.
*** For a better tommorow, change your life today ***
someone mirror and/or post text please.
Does this mean when all the script kiddies have their defacing party OSX will be worth less than 5 points?
-=LaptopZZ=-
First of all, the ctl-k ctl-y macros work in just about any Cocoa field. I pointed that out earlier on macslash. What I also pointed out was that this bug will crash just about every Cocoa app with a text field. I've crashed the login panel with it. It's not pretty. I really hope apple takes heed to this bug and fixes it at the core. Unfortunately the original bug report was.... well... not too elegantly written. We'll see what happens.
In the meantime security savvy users should logout rather than trust the screen saver and use an Open Firmware password on their machine. That way you prevent people from logging in using single user mode. Hit command+O+F during boot to get into open firmware, then type in password. After that type reset-all. You should be good to go. And don't forget the password or you will be totally screwed!
100% Crunchier
log out!
Today meaning July 4th at 3:00 pm, this bug made its rounds on every major vulnerabilty database before slashdot even posted it... Why doesn't slashdot get its own vuln db? Or maybe a link to bugtraq: http://www.securityfocus.com/archive/1
then we wouldn't have to get our vulnerabilty news a day late and a dollar short.
That should get him paranoid...
Anyone know any good keystroke loggers for Mac OS X?
Wow, a bug, who would have guessed software has bugs, oh, the horror.
It's only news becasue OS X doesn't have heaps of bugs like everything else.
I'd paste the list of current problems with glibc, but I only have DSL and it would take too long.
- Adam L. Beberg - The Cosm Project - http://www.mithral.com/
I would have thought that hot RMS action would be something only linux users would dream of
Sub'ing as AC - so I get no karma bitching. Oh, and OT, but this idiot can't write a sentance, there's no doubt he discovered this after falling asleep on the keyboard. fucking kids these days. :)
:(
CB
-=-=-=-=-=-=-=-=-
[Full-Disclosure] MacOSX - crash screensaver locked with password and get the desktop back
Delfim Machado bipbip@xpto.org
04 Jul 2003 15:23:03 +0100
* Previous message: [Full-Disclosure] Essentia Web Server 2.12 (Linux)
* Next message: [Full-Disclosure] MacOSX - crash screensaver locked with password and get the desktop back
* Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
--=-S6gunci//kb/Gq0/KoN3
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Hi all,
three days ago i discovered a security issue, with the last MacOSX.
there is a way to crash the screensaver locked with password and gain
the desktop.
how? - you ask.
i don't know the exact amount of characters, only that if you leave a
key pressed for 5 minutes or more and then hit the enter key, you crash
the screensaver and gain access to the desktop.
you can mess the desktop and all around it (network, mail, docs,
anything you can imagine).
i think that this is a huge secure hole and it must be corrected.
i hope that this is good for everyone who cares about "how to secure
your desktop".
solution?
wait until someone at the apple make a patch and realise it...
here is the mail that i've sent to apple security people, they didn't
replied
[cut]
Cheers
--
Delfim Machado - dbcm@xpto.org
XPTO:: Portuguese OpenSource Community - http://lab.xpto.org
I don't see what the big deal with this is. It's not like Apple hasen't released other security patches to OSX. Or are we "forgiving" them for stuff that is found in the non Apple specific parts (e.g. sendmail), if so, why should we, they ship it, they charge for it, right? Anyone out there honestly believe that there aren't a whole host of other issues just waiting to be found?
....that it's remotely exploitable.
Any machine you can get physical access to is insecure.
It shouldn't be that difficult to prove, though, if there's a cocoa-based network app where you could dump more than 2048 characters (Camino, perhaps?).
This is nothing to be upset about. Heck, windows users have had this feature since windows 95. 3-finger salute and end the screen saver task :)
:)
Security via screensavers should never be trusted. I'm not quite sure why its still being put in place. WindowsXP has a slightly better idea in that it will quick log you off if you ask it to... Of course gnome/kde stole that idea before MS was able to integrate it into XP/2k
Now, if this can be used as a buffer overflow attack as stated in the second link, that can be a problem. Not so much that a local user will overflow thier own system and gain local root, but the fact that this is the same throughout multiple cocoa apps shows the possibility of one of those being remotely exploitable.
Of course that's only for the 4 people running OSX as a server.
Karma: SELECT `karma` FROM `users` WHERE `userid`=138474;
and was able to crashed it, dropping me into the desktop, now I've tried it too on the Log-in and was able to crash it, sending me into a full Darwin/BSD console, you'll have to login again for you to be able to access the console though ... but full screen console Mac ... this you've gotta see. w007!!!!
Umm this one was in fact fixed a long time ago by a checksum on all the packages.
I'm not trying to blast Apple in particular here or anything, but it seems that all companies have had a poor record lately responding to security holes pointed out by email users. Recall the Microsoft Passport security vulnerability.
Granted, I would guess that the email volume these receive claiming discovery of new exploits is daunting, but doesn't this deserve top priority for response?
Well, to be fair Debian Linux suffers from the same problem. Trusted update is a more difficult problem than solving some buffer overrun in xlock or whatever.
I tried it on my iBook... waste of 5 minutes :/. I am running 10.2.6 with all the updates installed availible from Apple. I have 384megs of ram and a G3 800mhz. The guy on MacSlash says this works on his iBook. Could this be hardware related?
(I went over 5 minutes holding down a key and my repeat rate is the highest OS X allows so I don't think there is possibility for error.
Someone with physical access to your machine can access it!! WHO KNEW?! Call in the army reserve and physically secure access to all your machines!
I believe this to be the first "public" exploit of OS X, or any OS 9, in quite some time....
Not good say confucious.
Interesting, though...is the screensaver portion of the OS open source linux_bsd_mach_whatever or is it closed Apple source?
I got nothin'.
This was fixed July 16, 2002. Old news. Move along.
(It wasn't even that bad of a vulnerability, as it required end-user cooperation to exploit and also excellent timing/sustained penetration of the target network (software update runs once a week by default-- you need to guess when to arpspoof/dnsspoof properly. Still, it's not a good thing, and Apple fixed it promptly).
"Flying toasters are neat..."
"oh look, a CLI flying toaster."
heh, MS had a bigger screensaver exploit way back in NT4(perhaps earlier?). you could run any program with elevated privs by replacing login.scr with an executable. this is mildly irritating compared to that. seem to remember that the cd autorun feature would run applications behind a password protected screensaver in win9x.
screensavers should be abolished anyway, no real need and blanking the screen or sleeping the monitor is more effective, anyway.
Indeed. Hence the Windows comment. I was highlighting the difference between OSX and Windows' "bug release schedule". Comedy is wasted on slashdot ;)
uh i think you mean "security through obscurity" brainiac.
who needs 'em anyway?
Well it's not like anyone is going to be breaking in on my computer because I'm on all the time...
So this will only affect people who leave their computers, and at that, only users who do not shut down or log out when they leave.
...
If you have access to any machine, you can override security. Can anyone say, "boot up with a cd-rom"? I thought you could. These are the droids you are looking for, move along... move along...
It's no wonder why Apple didn't reply, look at the subject of the email sent to Apple: "forgot your screensaver password ?? Hackit anyway." Must have been Jeff K reporting the bug.
In other news, a similar bug has been an issue on the Mac OS X version of Folding@Home. The screen saver crashes when lock screen is activated, and it's been months since I first noticed it, and I've seen it mentioned on the Folding boards, and it still hasn't been fixed. I agree with some of the people on the Macslash forum: Don't rely on screen savers if you have truly sensitive data within in reach of scrupulous characters.
Boogle! Boogle boogle boo!
can hop up on the desk and crack OS X?
Wintel fanboys/Apple haters who are having your fun because (finally!) there's a security hole in Mac OS X, take note: This bug requires PHYSICAL ACCESS TO THE COMPUTER to exploit. Compared to the network security holes Windows is famous for Nimda, Code Red, IE-buffer-overflow-of-the-week, this bug is about a serious as a typo in a dialog box.
Got any numbers to support your closing the gap blathering? WIth that logic, Linux (insert flavor here) has the same problem. Carry on.
;p
It's always found this mildly annoying but since I've never had that much to protect and the people around me really arent that smart anyway I haven't gone in search of the fix.
But in X at least on slackware when the screensaver is on I can Ctrl-Alt-F1 and Ctrl-X to kill X windows and get myself to prompt.
I just pasted about 2.7MB of text into Safari's address bar, and it didn't crash at all. I pressed return, and it attempted to load the page; Squid aborted the connection but Safari's still trying to load it. I'm typing this in another Safari window. No problems. Process Viewer shows Safari is using 25% of my RAM.
This will probably make a pretty ugly entry in ~/Library/Safari/History.plist.
I also tried crashing the screen saver login window. It hung with the SPOD trying to manage that much data being pasted all at once, but it did not crash. After several minutes, I killed the processes remotely, but even killing the process did not return me to the desktop - I just got another login prompt, and was able to log in.
I'm running 10.2.6, the latest available version.
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
1. Send Apple bug information on leading Unix product
2. Apple does not achnowledge communication
3. Post bug on Slashdot.org
4. ???
5. Users receive eMail on newest update (Profit)
Well, well, well! This is a new communication trend I've been noticing latly from massive corporations; ala Microsoft, Apple, SCO, etc. Everyone seems to be speaking HTTP/Slashdot instead of NNTP/ASCII. Great work guys! Rub their feces in their faces publicly!
5. Profit!
If this is a buffer overflow, in theory it could let you run any code (though you would have to type it, restricting the instructions you can use...).
Running code with the screensaver privileges is not very interesting, but isn't the loginwindow runned as root ?
Defeats openfirmware password protection...
It sounds as if all you need to do I type in enough charaters in to the imput field fast enough, and bamm the screensaver or whatever app "crashes" and now you're as the desktop or in single user mode. I thought a true buffer overflow attack was something different than this.
||| I still can't believe Parkay's not butter.
I don't use this screensaver as a "screen saver". I use it as a "lock this terminal, leaving all my stuff open, cuz I really don't need to log, out, but I do want to prevent casual snooping when I'm not watching over the machine."
A beneficial side effect is that it prevents accidental things from happening, for examine, when the cat walks on the keys.
I saw this "exploit" on full-dis, where it started a rather large thread, given how silly this bug actually is (a screensaver breaker...ooooh now I'm quaking in my boots). I thought it was excessive that -anyone- responded to his thread, and now it got posted on /. ? What gives?
;)
Probably going to get modded down for troll, but I had to vent. Excuse me.
"Quoting famous computer scientists out of context is the root of all evil (or at least most of it) in programming." - K
Sten
Why do you have to bring linux into this? And what facts do you have to say that Macs are not closing the gap with MS in terms of breaches?
Couldn't get it to crash with 10.2.6.
:).
:-]).
Reminds me of the email I send to the admin/owner of the BSD server he used @ his ISP -- kicked my foot up and hit -0- while on the phone. Not noticing page after page their Unix box finally crashed from my tcsh. He had no idea why it went down (I did it three times to make sure it _was_ me
It was fixed fairly quickly (and it doesn't crash anything in OS.X or Linux either [anymore
I remember seeing the same thing back on a 3b2 running AT&T SysVr2 Unix waaaay back when.
Windows certainly isn['t much better...
That was a joke dumbass.
I'm also running 10.2.6 and I cannot repeat this bug. I'm also using the emacs shortcuts to copy and paste the text in the password field (since command-c and command-v are disabled). Maybe I'm just to impatient to take the time to reproduce this but my 450MHz PowerMac was becoming so slow between pastes that it was becoming intolerable.
Any machine you can get physical access to is insecure.
Not all physical access is the same. Many demo machines in stores are left in screensaver mode, so that they show the computer is "doing something" without allowing users to write dirty messages in Notepad (or whatever Apple calls its version; I haven't used a Mac since Mac OS 8.1, when it was called "SimpleText"). It's easy to interact with the keyboard of a floor model, but it's often not feasible to turn off the machine and insert a boot disk, and it's definitely impossible to open the machine's case without getting caught, kicked out of the store, and possibly arrested for attempted vandalism.
Will I retire or break 10K?
If I am not mistaken, this was on Slashdot a while back. Apple was quick to correct this.
The only problem(an ironic one) is that they updated the flaw through Software Update =)
tilTrue.info contechtext.info prettypowerful.info twitter.com/frets fb.com/prosody
Hah! I knew it! Mac OSX isn't based on Mach or BSD at all! It runs on top of emacs!
Actually, the thing that surprises me is that they managed to trim emacs down so it's only an operating system.
...you can probably just boot using a CD or external hard drive, which results in a much worse security problem, since it'll give you access to Mac OS 9. You can use that to trash the Mac OS X system, since you can destroy all the normally hidden files and not worry about permissions.
It doesn't seem to work for me.
You sure it's real? Have you verified it?
I'm running 10.2.6 on a 933MHz Quicksilver with SuperDrive
Tried entering another users's login and password at the screensaver prompt and could not get access.
When I used Folding@Home, however, I *could* crash the screensaver, and thus forcing the user back into the desktop, but that has nothing to do with the bug you're mentioning, but with the fact that Folding@Home crashes.
GPL Deconstructed
Okay now...Apple is swiftly closing the gap with Microsoft in the amount of holes it has.
Compare:
Microsoft
Apple
Notice how many of Apple's security holes are actually holes in things like Sendmail, BIND, Samba, Apache and CUPS, all of which are off by default, and affect Linux and FreeBSD as well.
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
It's a screensaver. It's not a lock-out mode. Hopefully, though, the new switch-user thingie in Panther will be what you're all thinking the screensaver is.
Well if OS X was really open source and not just a phony half-open half-closed marketing trick this pathetic exploit might have been fixed sooner.
If an exploit this dumb is discovered what else is lurking in there?
Sure it's good enough to do a little photoshop and play some mp3s but trusting it for anything important would be career suicide.
I can't remember if ctrl-alt-del worked to bypass the screen saver in Win95 (though I doubt it), but I know it never worked in Win98. The more effective way to do it is to burn a CD with a simple program that kills the screen saver. Unless the user actively searched out and disabled autorun, which is a much bigger safety/security hole that comes enabled on all Windows systems, it works flawlessly.
Of course, as others have mentioned, if you've got physical access to a machine, it's insecure. While I'm thinking about it XP and 2k have autorun enabled by default; I wonder how they handle autorun security when the computer is locked.
It's been discovered that someone with physical access to your computer can access it.
how the fuck is this "insightful"?! Mods are on crack again...
My local computer store has password-protected screensavers on all its demo Macs - now I'll be able to surf the web for... ahem... "those" sites... when the store employees aren't looking!
---
Hello, Slashdot user. My name is Dr. Sbaitso. I am here to help you.
Personal computers and workstations make no attempt to be secure against physical access. I just changed two Mac OS X root passwords so I could create an account for myself on some pc's last week. I'm not a regular mac user, I just did a google search and found three or four ways to do it, the easiest was to just boot into single user mode, turn on the standard password authentication mechanism, and then type passwd... I've never met a Sun workstation that didn't give you fully fledged debug console at Meta-A.. Lilo lets you enter single user mode with just a kernel parameter to linux... You can overwrite the password files in Windows, etc.
You could encrypt the root filesystem, then on boot authenticate the machine (to make sure someone didn't just clone the startup to harvest your decryption key) and then enter the decryption key based on a one time response from the computer. That level of paranoia would justify caring about this "exploit." Even so someone could just install a sniffer inside the computer since our hardware is not hardened in the least.
PowerBook G4 12" (iFootlong)
Mac OS X 10.2.6
Darwin Kernel Version 6.6
Wow. I'm shocked. That sucks. It's an easy-ass fix, though. Now to just shoot anyone who goes near my computer, until Software Update beeps.
Informatus Technologicus
The only wasted comedy is the jokes that either aren't funny, or aren't jokes.
Anyone else experiencing this? Is this a temporary fix?
I crashed both the login panel and the screensaver. I typed in some characters, ctrl-a/ctrl-k/ctrl-y, hold it down for a few seconds, then repeat the process. The text control fills up pretty quickly. Hit enter, and the application crashes.
For the login panel, it dropped me into console mode, but I wasn't logged in. Crashing the screensaver took me to the desktop. Not a big deal, in either case, but it could be a big deal with a different application.
Weird how some people can reproduce this and others can't. I have a PowerMac G4 (mirrored drive doors) running 10.2.6.
Mortal enemy of the Mastodon!
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
If you had more more brain cell
You're embarrassing enough for both of us.
I was able to reproduce it on my Powerbook. Here is the crash log.
/Users/jonathan/Library/Logs/CrashReporter/ScreenS averEngine.crash.log
2003-07-05 23:25:41.258 ScreenSaverEngine[9993] Exception raised during posting of notification. Ignored. exception: *** -[NSCFArray objectAtIndex:]: index (0) beyond bounds (0) Jul 6 00:10:42 localhost crashdump: Crash report written to:
-You may license this sig for only $6.99.
That's 800h.
-Libertarian secular transhumanist
Not even for 6 minutes.... sounds like bogus FUD to me.
How about APT Secure, which is the working name of a project to add to APT the ability to verify the authenticity of Debian packages. It accomplishes this via a chain of trust which is initiated by the package maintainers and ends on the installing machine.
Inconceivable!
Oh, and OT, but this idiot can't write a sentance, there's no doubt he discovered this after falling asleep on the keyboard.
Once again, our intrepid hero, known to his legions of fans as "Slashdot Grammar Nazi", fails to check his own grammar and spelling as he ruthlessly tears apart another post for...poor grammar and spelling.
A screensaver password vulnerability works just as well remotely as with physical access. The screensaver is just another X11 program which runs the same way whether local or remote.
While this in itself doesn't give *easy* access, it might very well open for a remote X spoof attack from a third party.
Regards,
--
*Art
Post the .pngs someplace! w007!
I'm using 10.2.6 on a dual G4 450.....
;-) )
I held the "x" key down for a little over 7 minutes (ok, I used my stapler to weigh down a battery that was placed to press down the key.....MacGyver lives
I agree with another posting that mentions one should actually log out the the account if they really want to keep their data safe.
My guess is that you'll see a security update in the next week.
ha ha ha..."refers something"? Oh my!
Was so immature, its no wonder it got ignored. :)
I would be surprised if the mail didnt get deleted after just looking at the subject of it
Seriously, people reporting security bugs need to start working on their english and sentence structure, and stop sounding like 10 years old script kiddies.
It's a feature!
/. reported a samba security hole about three months ago that I had patched about an hour before the article was even posted, thanks mainly to Mandrake's Security Update.
Seriously, all software produces exploits of some kind, even the beloved Linux and its considerably more stable cousin OpenBSD. The difference between an open source project like Linux or OpenBSD and more proprietary software like Cocoa and Windows is that more often than not if there's an exploit, the sooner it's discovered the sooner someone patches it, and as a result the sooner it gets fixed. I remember
Karma: Non-Heinous
Now this makes the bug much more serious. Any host that can ask for a login window on the machine can then use the buffer overflow exploit to potentially pass executable code to the server, to be executed as root.
Time to check your Xaccess file and make sure it doesn't allow any remote hosts, whether by query or broadcast. Or block port 177 and 6000 both ways.
Regards,
--
*Art
This requires "5 minutes" to hold down the key long enough. If one has access to a machine for 5 minutes then security doesn't matter. On any version of OS X one can simply launch up single-user mode when restarting and have Root access in under a minute.
Best. Webhost. Ever. Dreamhost.
This will be a good test of Apple to see how long it takes them to deploy a fix on Software Update.
Seems everyone is always judging everything by how fast their creators release security fixes!
Thats funny, my linux server has been up and serving pages for 2.5 years without a reboot.
I could not get it to work holding down a key but the cntl-k cntrl-Y worked for me.
The article says it takes 5 minutes to enter enough characters to fill the buffer, but my testing shows it can be done in under 5 seconds.
Of course results may vary from machine to machine. I happen to always use a key repeat setting of 1200 cps on my computer.
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
Oh you dont want to change the password? well then boot in single user mode and you dont need one. Ta Da
Oh they left open firmware on?. open the case and remove one of the memory cards. reboot. ta da!
Some drink at the fountain of knowledge. Others just gargle.
that's how Mystique hacked into that government computer in Xmen 2 -- and I'm pretty sure that's how Jeff Goldblum hacked into the alien ship too - only we didn't know it at the time because os X was only released to celebrites at that time.
(and that's why he did those commercials too!)
cyberRodent
Talk is cheap. Supply exceeds demand.
It probably didn't work for you because you didn't type enough stuff. Go buy a drinking bird.
On any computer using OSX, it is possible to change the root password with 6 easy steps:
/"
Reboot the computer
Hold down appl ctrl + S
Type "mount -uw
"su" (it dosen't ask for a password)
"/sbin/systemstarter"
"passwd"
You could just install Xlock (available via Fink, accordintg to this list) and run it from a shell. There should be a way to replace the default screensaver thing with Xlock too.
Overcaffeinated. Angry geeks.
I reported the same bug to Apple, only it delt with the login screen. You could overflow the password buffer and kill Aqua, which would drop you into a root shell. Although it was never mentioned in any of the security alerts, it was a problem up to one of the later 10.1 or early 10.2 releases.
Now with the PowerMac G5, OSX security holes can be expoited upto 32% faster than equivalent P4 systems running WindowsXP.
And port GNUstep over OS X or Apple should release source for Cocoa.
It's easier and quicker to patch a free software project.
This would only benefit Apple because sooner or later GNUstep will be stable on both Windows and GNU/Linux.
Anyone who has access to my Mac can't even remember their own 6 character passwords - I don't think they'll manage a 2000 char overflow.
While this is a bug in OS X, it really isn't anything more. It can only be exploited with physical access to the machine, something that we have known for a long time to be insecure. Apple should fix it for sure, but with the same priority given to any other minor crasher bug (minor as users cannot really expect the application not to crash when typing thousands of characters into the tiny password field).
Screensaver passwords provide no real security; anyone exploiting this issue in the real world would know many (far easier) methods and anyone with data that must be kept secure will (should) know better than to rely on the screensaver password.
Everytime someone posts a message about OS X, I try really hard to take it seriously.
:)
I repeat to myself..
Its a BSD kernel, its a BSD kernel, its a BSD kernel, its a BSD kernel.
But whats with the names? Safari? Jaguar? Panther? It's hard not to imagine mac users wearing helmets and riding elephants.
And its nearly impossible to say 'cocoa' without smiling? Seriously, try it.
Cocoa.
Steve Jobs:
Well you're going to be AMAZED by what we've done. Today we're ready to unveil... Coconut! Inspired by Guano, and the successor to Firefly. Fully compatible with Gerber API's.
Well, that just goes to show how much Apple has done for you lately! They just created a distro! You still owe it to the rest of the community for the help.
oh the humanity!!! I can just see it now... "well we relied on the IBM chip and SCO seems to have a problem with that. But hey look*poof* Ipod == good!!!
life is like a box of really fucked up chocolate...
This will probably make a pretty ugly entry in ~/Library/Safari/History.plist.
It didn't. Probably because the page never loaded.
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
If you had write access to \WINNT\System32 (where logon.scr resides) you were probably logged in with admin privileges already, so what's the point?
Of course this is a security bug; it's a bug in an authentication program which, when exploited, allows an attacker access to a computer that they wouldn't have otherwise had. How is that not a security bug?
If the user cared about security, they'd enable the OpenFirmware password feature. Without the password, you won't be able to boot in any way but from the default disk and with no special boot arguments.
Then you've never met a Sun workstation with its OpenProm password enabled. You can interrupt the machine with L1-A (and it's L1-A, aka Stop-A, not Meta-A), but you can't get anywhere without the password. I do this on my Ultra 1 and my Sparcstation LX.
Unless the 'password' option in lilo.conf is in use.
I'm not very familiar with Windows security, but as far as I understand, if you can prevent the hard disk from being removed from the machine, and you can prevent the machine from booting anything but the hard disk, Windows can be configured so that you cannot simply overwrite password files (or any other files, for that matter).
Keep in mind that on PCs, the BIOS can be protected from booting from anything but a hard disk.
Many PC cases, and every Sun case I've seen, have the option for installing a lock into place, so that the case cannot be removed without damaging the case or damaging the lock. Since the only way to circumvent a PC BIOS, OpenFirmware, or OpenProm password is to open the case, a security-conscious person would inspect the lock to ensure it hasn't been tampered with. If it hasn't, then it is extremely unlikely an attacker could have, for instance, booted their own OS and installed a trojan horse to the computer's disk which intercepts passwords and passphrases.
I havn't been able to reproduce this on my OS X.2.6 machine. Other 10.2.6 users have reported the same thing. It *might* have been fixed before it was found.
And my friends think I'm silly for wanting to write an OS and Desktop/WM in Ada. The only time I ever plan to use C/C++ again is for work. Buffer overflows, geesh.
Just FYI Panther seems immune to this exploit.
Tried doing the procedure ~10 minutes in the Screen Saver and nothing happened. Then tried again in few other cocoa apps. Still nothing. Just worked like normal(for once this is a good thing).
My only question is if Apple acknowledged this flaw in Jaguar and then fixed it in Panther, or if Apple just ended up fixing it quite accidentally.
And yes, I realize most people can't just upgrade to Panther yet to fix this rather major oversight on Apple's part.
Yea and I think that you should be able to use Exposé as a screensaver =)
tilTrue.info contechtext.info prettypowerful.info twitter.com/frets fb.com/prosody
As one of two people ho runs vim rather than a GUI editor on a handheld, I should have a whitty anti-emacs remark to put below.
/>
<joke subject="emacs"
You can't judge a book by the way it wears its hair.
But everytime I try and type it into my Mac Steves head fills my 23" cinema display and tells me I need to listen closer to the next keynote. I think it's a security feature.
People who bite the hand that feeds them usually lick the boot that kicks them
I was not able to reproduce the same effect, i.e., screensaver did not crash, by following the "exploit" mentioned on two 10.2.6 systems: G4 AGP tower and 12" G4 PowerBook, both running the Flurry screensaver:
G4 Tower:
Darwin bogon.local. 6.6 Darwin Kernel Version 6.6: Thu May 1 21:48:54 PDT 2003; root:xnu/xnu-344.34.obj~1/RELEASE_PPC Power Macintosh powerpc
12" PowerBook:
Darwin Rouge.local. 6.6 Darwin Kernel Version 6.6: Thu May 1 21:48:54 PDT 2003; root:xnu/xnu-344.34.obj~1/RELEASE_PPC Power Macintosh powerpc
--Rick "If it isn't broken, take it apart and find out why."
This requires "5 minutes" to hold down the key long enough.
To set of the C-4 charge under the desk.
Diplomacy is the art of saying "Nice doggie" until you can find a rock. Will Rogers
It just works?!
Seriously, people reporting security bugs need to start working on their english and sentence structure, and stop sounding like 10 years old script kiddies.
Perhaps English is not his first language:
"Delfim Machado - dbcm@xpto.org
XPTO:: Portuguese OpenSource Community - http://lab.xpto.org"
I got drunk last night and passed out at the keyboard and came 'round *six hours later* - a lot longer than the 5 minutes needed for this "exploit" and I STILL couldn't get into my Mac OS X box.
Couldn't find any more beer, and I couldn't find my pants, either.. but that's another story.. grrr
I remember once I had to get "root" access on OSX. So I held down the two buttons on the bottom left of the mac keyboard (I don't have one here, so I can't say which ones). Then held down 'S' (or a key around that area) and powered on the box (If you could call it a box) I was then presented with a bash prompt and full access. Sort of like init=/bin/sh, or single user mode.
So you do not need buffer overflows or anything like that if you have the box in front of you and you have a hammer.
DOS: smash the box until it no longer works.
root exploit: smash the box and get the hard disk. Plug that into another computer.
it is only after a long journey that you know the strength of the horse.
You could always set an Open Firmware Password, if you're afraid of people rebooting your system to exploit it.
...when Xjournal does everything it does, and a hell of a lot more?
Since the only way to circumvent a PC BIOS, OpenFirmware, or OpenProm password is to open the case, a security-conscious person would inspect the lock to ensure it hasn't been tampered with. If it hasn't, then it is extremely unlikely an attacker could have, for instance, booted their own OS and installed a trojan horse to the computer's disk which intercepts passwords and passphrases.
An $8 hardware keyboard logger can get someone a long ways unless you take more than a cursory look at your hardware. Not that you shouldn't do all those very common sense things you suggested. When I was a kid I had a bad habit of breaking into machines that looked "secured." The tougher ones took all the measures you suggested and then encased the machine in metal or plexiglass. Those machines took up to an hour to break into. Unfortunately, when it comes to these things the kid will break into more of those machines than the totally unsecured ones because your machines present some challenge. The easy machines will be accessed only for convenience.
Lock the door to your office, and worry about someone running NFS or a Windows machine on your network.
why is it no one cares so much about this.. oh wait - it's not an ms windows flaw/vunerabibity so therefore it's just "ome of those things with os's" - if this was found on a windows os, these forums would be full of "oh christ, windows is so insecure - even their screen savers are vuberable"... look at them apples...
GO
BACK
TO
GBS
OMG OMG LUNIX OMG
This exploit requires physical access to the machine, and if you have physical access, it's a lot simpler to just kill the power, and reboot while holding command-S.
I haven't been able to reproduce it on my machine, but even assuming that the original report is completely accurate, it's still not a big deal.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
I think the update is about to be released, I can't access the software update servers. I think that usually happeneds just before an upgrade
Sig you!
That's because Microsoft has its own software that does the same thing, so that bug in Microsoft DNS, SMTP service, etc. is no different from Apple's BIND bug, it's just that Microsoft wrote the whole operating system, and Apple obviously didn't so there's more Microsoft code to have bugs - more code more bugs simply statisitically.
OMG, this thing actually works.. I am taking summer school classes and got saturday detention for cutting one of my classes earlier in the week. I tried the sploit at school on the macs there BEHOLD it freakin' works!!!
.. Ohh, sweet.
It works in ANY of the OSX apps I tried. My school has some security software installed to prevent us from running anything other than IE and some mail program for the schools e-mail. Now I can get access to play games (i'm bringing my diable cd's monday)... In fact.. It might even work as a way to gain access to the teachers grading software
didn't you mean vi? just type yy2048p in normal mode :-)
however, does your comment mean that the default keybinding of an apple computer is the same as used in emacs?
oh yeah - you mean the functionality that Apple "borrowed" since they couldn't make it themselves; but then if there is a flaw they can shift the blame. I guess Billy Gates is not as smart as Jobs - he should have been more obvious when he stole parts for his OS.
1 "The OSX desktop isn't networked, so this isn't a remote exploit, so it doesn't matter, anyone with physical access can break in anyway"
2 "OSX is not real bsd / not real unix"
3 "This is what you get for having closed source"
1 - Yes, it's more or less a local exploit. So what? Does that mean it doesn't matter?
2 - Yes, it is.
3 - Lots of open source apps have had security vulnerabilities. Let's wait and see how apple deals with it.
Does that mean you run with all local passwords disabled? I mean, if they have physical access, what's the point?
I tried both scenarios described without success.
GJC
Gregory Casamento
## Chief Maintainer for GNUstep
To a certain extent. Bios passwords on PCs and OpenFirmware passwords on Macs. Yes, you can get around them, but you have to open the case to do so.
Enjoy.
When you think about it, this isnt that big. I am being a bit redundant but all a screensaver does is pull wool over the prying eyes of others from your screen.
/var/log and stuff like that. Which they shouldnt, in that case, if you have administration privs, then yes you should be logging off in some enviroments every time you go get a tissue or some more HyperMints.
Of cource then it is a small problem, and the fact that I cant see a fix makes me proud to be using an Operating System made by geeks for geeks (Linux). For example in a some enviroments and other situations logging out is not always practical.
On top of this consider that tbis can be logged unless the user has permission to root with the
But there is to much Media Whoreing as usual by countless nobodys that are dieing for attention, it happens all the time, people start websites, make action groups all for the wrong reasons. People start a great many projects on sourceforge that never actually happen. I big example of media whoreing is the SCO case. Walk up to your average joe blow and ask what he thinks about this stuff, not much. Or ask Linus Torvalds, what DID he think, not much. The fact is nobody really cares about this stuff, and im including geeks. Its these attention whores that need to be filtered.
Its the same in this case the AH (Attention Whores) keep focusing on the negative as if the US run OS X with screensaver passwords to control there nuculear goverment or somthing. What about the real issues, like standing for what you belive in, if you dont belive in in anything then just get out of the path of those who do. Its purely selfish, and on the whole can gradually ruin things for the rest of us.
I wrote this because this article and the way people flaired up on it sorta told me what 90% of people dont mean what they say. This article told me how much time is spent on what is important.
Awww, this ain't nothing!
You folks seem to forget the mother of all intended security exploits: FireWire Target Disk Mode. Officially sanctioned by Apple for the lazy 'l33t h@x0rz' among us.
To have full unfettered access, as it completely ignores the UNIX permisions, to any and all data on a Mac User's computer simply hold down Apple+T on the victim's computer connect via 6pin-6pin firewire cord to your own computer.
Happy copying. Maybe with the additional data features of Panther this wont be an issue, but for now, happy downloading. ^^
I tried it with three screensavers.
Only Folding@Home crashes.
The other two did not; and this 'Any User Logs In' bug that was linked to, if you read the same post I did, has *nothing* to do with a buffer overflow. The thread *I* am reading says if you use *any* valid login, you can disable the screen saver.
While I tried, I could not repeat this supposition.
GPL Deconstructed
Because, 30 years ago, people decided to adopt the idiotic C language rather than any of the existing programming languages that knew what a string was...
We've been paying for that mistake ever since.
Riddle me this Batman, why is it an outrage when something like this happens in windows but when it happens in an alternate OS it is an overreaction.
Is it possible that you (and many others here) have double standards?
The Internet is full. Go Away!!!
i would be concerned.. if i used such silly security.. but if you are concerned: the 10.3 developer version rips up how users enter passwords for screen savers, awoken systems and so on. Chances are it's already been out-coded in the next version.
I put all my kiddie porn and recipies on my Apple; does this mean I have to move them again?
Manipulate the moderator system! Mod someone as "overrated" today.
If you're only within reach of scrupulous characters, security isn't a concern. ("Scrupulous" = "having scruples"; "scruples" has a similar meaning to "morals" or "ethics")
Of course, if there are any unscrupulous characters around, then you need to think about security.
Use a password for a user/admin account in Mac OS X that is longer than 8 characters. Enable file sharing, then log into it from another system using either the first 8 characters only, or followed by random text. The host machine simply assumes the password is valid after only the first 8 characters match up.
8==8 Bones 8==8
Am I alone in the fact that the OS X screensaver password doesn't work at all anyway? Ever since I replaced my beige Windoze box with a lovely dual processor G4 at home, all it takes to get rid of the password prompt on the screensaver is to wiggle the mouse a bit.
This is problematic as it means that I can't easily secure the machine when my cleaner/nosey friends come around, without turning it off or logging out. I've heard people mention third party apps to use instead, but I kind of think that Apple should be able to get something as simple as this right. My machine is running 10.2.6 and I have all the patches via Software Update - where am I going wrong?
Emacs stands for Eight Megabytes and Constantly Swapping
You can't judge a book by the way it wears its hair.
I tried the exploit with my screensaver and got right in. Fortunately, I usually keep confidential data on encrypted disk images. If you leave them mounted, they will re-lock when the machine sleeps.
I also tried the exploit on the password dialog for an encrypted disk image and it did indeed crash but I did not get access to the volume. The dialog box remained up and could not be dismissed but the image mounter said that the filesystem could not be mounted because of an error of type -60008.
In that what you call somethign is arbitrary. .
You say "netBSD and FreeBSD and OpenBSD kernels are similar" or "You only call it linux becaues of the kernel"
Yes, these are all true statements.. but unfortunately, it means more than that, at least to many of us out here.
When someone describes a system as "BSD" I expect to find the bsd style tools I expect on a bsd system.. and that is FAR more important to me than the innards of the kernel I may never ever get to even see. There are many more real world implications of calling it BSD than the kernel.
GUI is not OS, as you say. Couldn't agree more.
If you don't want to call OSX BSD, that's fine.. I guess BSD has different meanings for you. It probably means "FreeBSD or NetBSD or OpenBSD.
Personally, I have a problem calling FreeBSD BSD or OpneBSD BSD.. as none of them are actually BDS, they are derivations of it.
If you think "Linux" Just means the kernel... well, sure, that's technically correct, I surely understand that... but when people talk about a "linux server" you know damn well they are talking about more than just the kernel.. the same goes for when people in general speak about bsd.
Not everyone is a kernel developer.
Recompilation doesn't bring a lot of issues; porting is rather easy. Does that make it simpler?
enogh of this boning. You need to get some bonercoaster Oh! Oh! Priorities. Your cereal taste like mascara. And I don't think this is 1985, so that shit is not gonna fly.
BTW, if you were born in 1085, this year you're legal. And if you're from mars and yhou have a pussy, I WILL FUCK YOU!
|/\/AN|
PS I can run two pussah
Well.. i politely disagree...
30 years ago you could use ASSEMBLY (but that would have been very bad) or C... Pascal Sucks...
Lisp is really good (I love it), it's string aware... there wer also Lisp Machines and all that stuff...
but dynamically resize arrays (that is basically what needs to be done when dealing with strings) is time consuming. Today there is no problem, still old machines...
Of course you can tell there where other programming Languages...
But considering C idiotic... well
Using C is a very good way to understand how the machine works... and if you are skilled enough you understand which assembly code lies under C code...
Think C as a kind of structured assembly...
and then... do you think you could develope an OS in java??
I don't want to start any blasphemous rumors but I think that God's got a sick sense of humor. DM
I tested the exploit by copying/pasting blocks of text, and although the screensaver server failed momentarily, it came right back up and I had to enter my password to get to the Desktop.
Seems to me this is not a universal hole (i.e. it might be something on certain people's machines).
I got the screensaver to crash--but it comes right back on!
I've verified this on 2 other machines.
Obviously you weren't around 30 years ago. For example, Pascal didn't exist. Perhaps you should look into the capabilities of PL/I (or PL/S or PL/AS for writing an OS) or ALGOL for examples that had been around a LONG time by then or SmallTalk-72 for an almost exactly 30 year old example.
Handling all data as a byte stream is pretty stupid for a general purpose language. (C was made for reading telecom streams and it makes some sense for that limited use) Handling strings as "start reading a stream at fixed memory location and keep going until you hit the magic cookie" is flat out idiotic.
I'd suggest reading the ACM's history of programming languages books to see what we lost by commonly accepting C just because it was cheap and easy to implement.
You guys keep saying that since people have physical access they can rest the password anyway... that is not the issue. I have tons of apps that are open at the same time at work. (Photoshop, quark, Golive) Golive is linked to more than 4 network servers mounted on the desktop. When I log in it takes more than 5 minutes to load all apps and files. I can t log off everytime I go to grab some water or leave my desk for a meeting. Our webserver has more than 25 thousand pages and they all need to be loaded/parsed by Golive on launch. What I need is to protect the machine from temporary access from co-workers/consultants etc. looking for personal/confidential stuff. They will not reset the password because that would raise eyebrows, what they need is stealth. This needs to be fixed very very quickly since login out all the time is NOT an option for me.
Ooh, I'm all goose-pimply. I don't know about y'all, but when I see something like that in the first paragraph it takes a mighty effort of will to read the second.
Behold the riant ape! Beware, his crooked thumbs!
Someone exploiting your system can always remove the RAM to reset OF. If hostile forces have physical access to your machine, they will be able to use it.
I don't even know what Apple Remote Desktop is, but when I want remote functionality to my OS X machine I use ssh, like I would with any other UNIX.
IF you were born in 1085, you are 918 years old, and I don't know what you have to be 918 to be legal for, but it must be dirty.