Hacker News Reader

Comment by thought_alarm | Hacker News Reader

No mention or actual "root" access, just "shell" access under the user's account. While that's still bad, obviously, on its own it's certainly not "wormable", as the article suggests.

More hysterical reporting from The Register.

View on HN

I contacted the author asking him to verify the claim of "root" access, since it makes a difference to those of who know what that is. He replied with an apology and updated the headline.

Maybe someone should change the title here here, too, then.

I don't agree that gaining control of the user account is that much smaller of a concern then root access. You can do a lot on a Mac with just the user account. And then, local exploits providing privilege escalation are relatively common.

How many Mac owners do you think run their admin account as the personal account. I bet more than a few don't bother with the distinction between user and admin.

That's like asking how many ubuntu users run their account as root. Almost None. The default in both cases is a normal user with sudo access (requesting a password). I'm not even sure where to start if I wanted to log in as root (not just in a terminal).

I just tried logging in as root on my Mac from the graphical login, works fine! If you don't know your root passwd you can also 'sudo passwd'.

There's no advantage really, though, since the gksu style authentication popup system when you need admin privileges is very painless. I too doubt if many people run their Macs as root.

The root account is not enabled by default. Did you set an account password for it at some point?

I did, yes. I have no idea when or how.

Maybe when you typed 'sudo passwd', which created the root password. Just as in Ubuntu the root user exists, the account is merely locked (see 'man passwd', -l option)

Apple describes how the Right Way here http://support.apple.com/kb/ht1528 but I'm sure I've never seen Directory Utility before. However, in the Edit menu they reference, it said 'Disable Root User', not Enable, so it's been activated somehow. Perhaps doing sudo passwd did it, though I don't recall setting it up through an unofficial method such as that on my Mac. I'm not really comfortable hacking around on MacOS since it's a bit different than Linux, being a BSD, and the extent of integration between traditional text file style configuration and Apple's GUI stuff is unclear to me.

I previously enabled it via Directory Utility, but disabled it again and tried it for you:

    $ sudo passwd
    Changing password for root.
    New password:
    Retype new password:
    passwd: Unable to change the password for record root.  Credential verification failed because account is disabled.
    $

So there you have it: you couldn't have done it this way.

I agree it's hugely light on technical details. But, if the exploit gains shell access to you own account, and the exploit can occur via simple message sending in Skype, and it is possible to script Skype from the command line (Applescript perhaps?) then I can't see why an appropriately crafted exploit couldn't message all your skype contacts once you get infected. This would spread rather fast :-)

Reply on news.ycombinator.com