Slashdot Mirror
macOS Exploit Published on the Last Day of 2017 (bleepingcomputer.com)
An anonymous reader shares a report: On the last day of 2017, a security researcher going online by the pseudonym of Siguza published details about a macOS vulnerability affecting all Mac operating system versions released since 2002, and possibly earlier. Siguza did not notify Apple in advance, so at the time of writing, there is no fix for this flaw. Despite the doom and gloom, the vulnerability is only a local privilege escalation (LPE) flaw that can only be exploited with local access to a computer or after an attacker has already got a foothold on a machine. The vulnerability grants root access to an attacker. The issue affects the IOHIDFamily macOS kernel driver, a component that handles various types of user interactions. Siguza said he read about various flaws in this component and took a look at it to find new ways to compromise iOS, Apple's mobile operating system, where IOHIDFamily is also deployed. The expert says he found the LPE flaw in the IOHIDFamily code specific to macOS versions only. In a tweet, Siguza said, "My primary goal was to get the write-up out for people to read. I wouldn't sell to blackhats because I don't wanna help their cause. I would've submitted to Apple if their bug bounty included macOS, or if the vuln was remotely exploitable.
Oh, it's "only a local privilege escalation". No worries then.
For the majority of use cases, that's pretty much it; you still have to convince someone to give you basic (local or remote) access to the box first.
Same story on *any* OS, come to think of it.
Quo usque tandem abutere, Nimbus, patientia nostra?
Without a visionary in charge, the company cuts corners and is losing major ground in 2018. If I owned Apple stock it'd be sold today.
The best thing that could happen to Apple (and to Apple users) is if Elon Musk took control of Apple without him losing any influence at Tesla or SpaceX.
These companies are a good fit, really. Tesla would have Apple product design power and Apple could benefit from someone clearly on Steve Jobs' visionary and operational level.
Something like this or similar: https://www.marketwatch.com/st...
Stupid. Fucking. Hater. Die Hater, Die!!!
From TFS, this Vulnerability has likely been around since 2002. Steve Jobs didn't die until late 2011.
So, what in the FUCK does the loss of a "visionary" have to do with this Exploit?
Answer: Abso-lutely FUCKING NOTHING!!!
So, go Hate somewhere else, Moron! We're busy here...
Early on in Mac OS X's (as it was then) history, Apple released the very first version of Safari. At that point, thanks to the Jobs vision of "It just works" coupled with the way earlier Mac OSes had run, to install an application (including setting it up to open files of a particular type by default) you just needed to copy the application to your hard drive. Anywhere on the hard drive. It didn't matter where. The operating system would automatically set everything up.
(And, to be fair, that's not a bad way to work, except...)
Well, Safari would also open and extract any ZIP or .SIT (a Mac specific archive format) file if you downloaded it. Automatically. It woudn't ask you, it just assumed you wanted that. Because, remember, Steve Jobs, "It just works".
So to install an application on someone else's Mac, all you had to do was make your web page redirect to a ZIP file, containing the application. And if, say, you made that application open files with a common suffix, and you also send a file with that suffix, then the moment the curious user double clicked it, it'd launch your application.
It took months before everyone was able to persuade Apple this was a bad idea and a version of Safari was released that didn't automatically open Zip files.
Jobs had vision. But to infer from that he was security minded would be a mistake. He was interested in making computers easy to use, but security got in the way of that, and it took a long time before anyone inside or outside of Apple figured out how to make security easy to use as well.
You are not alone. This is not normal. None of this is normal.
Stupid. Fucking. Hater. Die Hater, Die!!!
Why the fuck did this get (+5)?
Avantgarde Hebrew science fiction