Hacker News Reader

Comment by forgotmypw17 | Hacker News Reader

How crazy is it that getting root on your own device is an accomplishment?

Edit: I didn't realize this post is about a privilege escalation exploit, not about getting root on your own device necessarily. My point still stands though.

View on HN

For a random bit of code that's running on your machine? zero day levels of crazy: that should never be possible, and you should update your macos if you haven't yet.

This is not about "you being able to become root", of course you can do that whenever you want, with authentication. This is a random bit of code that compiles to something that goes "cute, let me just get root access without any passwords or user noficiations. Tadah, I can do whatever I want on this system now"

> This is not about "you being able to become root", of course you can do that whenever you want

"of course", yeah...

Tell that to iOS and most Android users (even among techies, 95% is afraid of the steps you have to take for getting root on your own damn phone). This used to be normal but for our own good it has been decided that this is not normal now anymore. That kids are growing up with this worries me. When is the market ready for Microsoft and Apple to decide the same for desktops? Not running the DRM and trying to WINE some application is going to be similarly thwarted as doing banking on a phone that the user fully owns is today.

I wonder how dangerous it really is to have root access on your phone? How many people got real damage by rooting their phone for their own usages?

All people just say it's dangerous however I cannot find data or user reports of people who got hurt badly by rooting their phone and a malicious app was exploiting this attack vector (wonder how big of a deal this niche attack vector is anyway). Sure some people shoot in their own foot with root but that's the danger of root anyway.

How are personal gripes about phone operating systems even remotely related to the factual matter of being able to su/sudo whenever you want on a desktop operating system?

Just pointing out that what you take for granted today is being removed from newer systems (which additionally relates to the thread as a whole since it uses an alternative way to get ownership over the software running on the device), so maybe it's not such an 'of course' anymore in the way you said :(

Sorry that I wasted your time with my, eh, "personal gripes"

The alternative is the internet would be vastly more saturated with botnets and the accompanying fraudulent they are used for.

I totally get what you are saying though. But kids these day can have way more impact than the bad old days of C64 command line basic. It’s just at a different level of abstraction. And people who want to tinker with the bowels of a device can always run Linux or one of the many microcontrollers on the market. A $5 ESP32 can do way, way more cool shit than my old commodore computer.

We've had smartphones without superuser rights for checks notes literally forever. There hasn't been a single mass market phone ever created that required you to run anything as root. Yeah, we can jailbreak phones, but until the law busts up the "app store" model, phones don't need root. General computing devices might, and you might want to turn your phone into one of those, but as the device it's sold as, no phone has ever needed you to have access to, or use. , root privileges.

Because they're not designed to be computers (yet). Operating systems for desktop have given you the power to superuser-up since day one, to this day, and the odds of that changing any time soon is pretty much zero, because without superuser privileges we can't use those computers for what they're intended to be used for.

So yeah, personal gripes: they are wildly and completely different types of devices, for different markets.

The vulnerability isn’t that the person who owns the machine can get root. Your user on a personal Mac is, by default, an Administrator, and can just sudo to root.

The “accomplishment” is that somebody who can execute code on your laptop (say, somebody who notices you forgot to lock your laptop at Starbucks, or a malicious app developer, or somebody who compromises the update server for an app you use) can escalate to root.

How crazy is it that getting root on your own device is an accomplishment?

We're not living in Commodore 64 days anymore.

The vast majority of people have to be protected from themselves, or they'd all be following online instructions to delete files in Win32 to free up space.

On HN, people know what they're doing, but for some reason complain as if every person on the planet has the same level of technical knowledge they do. They don't. People on HN like to moan about not being able to hack stuff because they think it gives them street cred. It doesn't.

HN: "This product is awful! It has no security!"

Also HN: "This product is awful! Its has security!"

It is as it always was an attitude of trust and defaults. You can get locked down bootloaders that only load windows and specifically signed Linux distros. This is totally fine for the 99%, but still most bios allow you to drop into non-secureboot if you choose. They've given the trust that you're going to do so responsibly. No random is going to do this for lols. It's largely for enthusiasts and non-institutional professionals building their stacks.

This is the have your cake and eat it too. Android has its "dev" mode, and most android phones allow for bootloader unlocks. Giving people to option to explicitly drop the security for their own reasons is great as long as the default is " idiot proof". Who's complaining about this model? Nobody

And honestly there are way cooler “raw hardware” things out there now that you can tinker with. ESP32 or even an Arduino can run circles around a C64 as far things you can do… (at least I can think of… who knows what my life would be like growing up around $5 microcontrollers with easy to use IO and whatnot…)

Indeed, plenty of power, ESP32 even has more juice than a PC 1512, and we got plenty of games and other stuff on them.

Right, the hard question is how do you prevent the spread of trojan horses which use basic social engineering?

It's not difficult to get people to run a sketchy program and type their password into any old prompt. You need layers upon layers of security to mitigate this.

it's privilege escalation, the script is not being run as sudo

also you can enable root by going to Directory Utility -> (unlock) -> Edit -> Enable Root User. Haven't found a need for this though.

It depends. Privilege escalation can allow rootkits to install themselves. To get a really severe exploit you usually need to combine a remote code execution with a privilege escalation. So this would only be one part.

But you never know if somebody already has another zero day exploit in their pocket and waits for such an opportunity. Some bugs are there for years before they are found. This doesn’t mean that nobody found them before. It only means that nobody used them in a way that it got detected.

Is a rootkit possible with SIP turned on? Seems like that’s what it is designed to prevent.

This is a privilege escalation exploit, it gets a root shell from a non-root process. You can get root privileges on macOS using su/sudo.

It doesn't have to be your machine -- imagine this is a Mac in a lab or a cloud machine.

Many, many macOS devices are not 'your own' devices, and have access to many development backends and infrastructures.

That has nothing to do with this. Everyone can become root on their mac by typing their password. This exploit shows that you you can compile a bit of code that can then bypass that and run anything it wants with full root permissions.

In most cases, yes, but that's not what the parent meant. In managed environments, it's common to not have root login access, and local privilege escalation is sometimes more critical than normal.

Only if you have admin permissions. If you don’t have them, you need to type in the password of an admin to become root.

Flamebait?

If you know the password you can enter it when ‘su’ asks. This vulnerability allows all processes, even untrusted one, to gain root privileges- which is a problem if that is not what you intend.

MacOS is actually less locked down than a Linux server built by even a half competent sysadmin.

> MacOS is actually less locked down than a Linux server built by even a half competent sysadmin.

In no way is this true. Linux servers built by half-competent sysadmins don't have System Integrity Protection, read-only boot images with digital signatures, or even proper secure boot.

Or any of the ARM hardware security features like PAC.

Reply on news.ycombinator.com