Hidden backdoor API to root privileges in Apple OS X
truesecdev.wordpress.com
truesecdev.wordpress.com
What? So all OS X boxes are simply broken, privileges-wise, if they're not on 10.10?
Most developers don't bother, as Apple has successfully made it quite difficult.
Just because something is free doesn't make it better.
And now this crap. Ugh.
While "upgrading" to 10.10.3, my computer failed to reboot itself. It just sat there, black screen, with a little spinner, for about 2 hours. Hard reboot, everything is back to normal. For now.
I fully expect 10.10.4 to actually destroy my hard drive at this point, as well as cause my monitor to spontaneously get 30-40 dead pixels.
Sucky part is, I feel I have no alternative.
Windows is out of the question after seeing what a factory OEM image comes with nowadays. I'm not giving them money and spending 2 days formatting/reinstalling/seeking out drivers on slow Taiwanese servers just to make a half-usable computer. And then, after all that, spend another 2 days installing various adware infested shitware to get a fricking PDF viewer. And don't get me started on getting a half-decent dev environment going. Ugh.
Linux is almost there. It's a crap shoot for me, unless it's running in a VM. I never know which kernel update will fix my trackpad/break my sound/wifi and which will fix the wifi, break suspend, fix sound, but break xrandr or some other archaic XWindows-related technology.
So, OS X it is, for the time being.
Microsoft Signature PCs solve this problem. :)
http://www.microsoftstore.com/store/msusa/en_US/cat/Signatur...
I'm never buying a Windows laptop, so it doesn't affect me, but I'm still the resident "family IT specialist". And I know, I just know I'm going to be asked lots of questions I don't have the patience for, as these poor bastards wonder why their computers are slow, all because the shitty OEM wanted to make a few cents off pre-installed shitware.
It doesn't affect me directly, I don't touch Windows laptops unless I'm wearing gloves, but the principle of the thing pisses me off. You're being treated without respect, basically.
It's like a car manufacturer selling you a car with a "feature" that takes away 50 HP to play a jingle every time you turn on your headlights, all because the got paid $7.34 by the jingle manufacturer.
Not that bad, but my car does come with what amounts for an advertisement for Sirius Radio built in.
:(
I was also offered a TON of extra add-ons when I bought my car. I'd say it was roughly equivalent to the process of setting up a new low-end PC in regards to the number of ad requests I got.
On the PC side, this is all typically mitigated by not buying the cheapest PC possible. In my experience (and this is not universally true!) the higher end SKUs are more customer centric, since at that point the customer is the one paying the entire cost of the device!
(See also, Nexus devices versus carrier branded phone models!)
I know what I am doing, and I still budget a good couple hours worst case to get all the drivers up and running again.
Just get Ubuntu Certified Hardware. They have over 500 models of laptops they certify. I have never had a kernel update break wifi. I don't know about all the other stuff, but most distributions store old kernels and allow you to boot back into the old kernel pretty easily. Don't know if this is an option on OS X.
Most of the upgrade pain I've had has been caused either by the migration to systemd or by the decision to unify /usr/bin, /bin, /usr/sbin and /sbin into one folder.
Fair play. Research the manufacturer's policy if you're buying pre-built. If you build your own desktops, this is not an issue.
>I'm not giving them money and spending 2 days formatting/reinstalling/seeking out drivers on slow Taiwanese servers just to make a half-usable computer.
When's the last time you actually installed drivers on a fresh Windows install? I will concede this used to be the case, but nowadays the whole process is much more streamlined. Microsoft has made progress on supporting a lot of hardware drivers via Windows Update. Intel also has a great driver update tool that will scan your system and make recommendations.
>And then, after all that, spend another 2 days installing various adware infested shitware to get a fricking PDF viewer.
2 days is rather exaggerated. Most browsers display PDF. If you absolutely need to read a PDF, Foxit Reader is free, as in beer. Yes, you'll have to uncheck some boxes to avoid their bundled software. Big deal.
>And don't get me started on getting a half-decent dev environment going. Ugh.
Yeah, windows isn't great for a lot of developers' needs. You really could have just left your argument at this rather than spouting off the rest of that FUD.
I use Linux, OS X, and Windows all on a regular basis. They have their strengths and weaknesses, like any other products.
I can build my own desktop, but I can't build my own laptop. I use laptops exclusively for work.
>When's the last time you actually installed drivers on a fresh Windows install?
Less than year ago on my girlfriend's VAIO laptop, actually. Windows 7.
>Microsoft has made progress on supporting a lot of hardware drivers via Windows Update. Intel also has a great driver update tool that will scan your system and make recommendations.
Yes, it mostly works, and I'm aware of it, which is why I boldly told my girlfriend I'd take me "an hour or so" to "fix" her laptop issues. Famous last words. And I wasn't exaggerating about "slow Taiwanese servers" - I'm talking less than 100kb/sec transfer speeds. Welcome to 1996.
>2 days is rather exaggerated. Most browsers display PDF. If you absolutely need to read a PDF, Foxit Reader is free, as in beer. Yes, you'll have to uncheck some boxes to avoid their bundled software. Big deal.
It is a big deal, to me. I don't like being treated like an idiot, being on the look-out for hidden toolbars and spyware every time I double-click "setup.exe". Am I capable of doing it? Yes. Do I want to bother, for a fricking PDF viewer or a java runtime? Absolutely no way, never again. BTW, 19/20 people seem to just leave the default check-boxes checked, since they don't understand what they're being asked and just want a fricking PDF viewer.
And Foxit IMO is a PITA. Comes with its own auto-updater too. I have never seen a PDF viewer needing so many automatic updates, so often; big ones, too.
Why can OS X come with a nice, bundled, PDF viewer, and the capability to export to PDF from everywhere, and in Windows-land, I'm forced to install either spyware or shit-ware? Why? Why is Windows still stuck in 1997 in this regard?
>Yeah, windows isn't great for a lot of developers' needs. You really could have just left your argument at this rather than spouting off the rest of that FUD.
FUD? I deal with Windows issues from relatives on a weekly basis. What FUD? Am I imagining all of these issues? Spyware and adware infested boxes that come to a crawl as soon as the poor sap has more than 2 Chrome windows open because the OEM decided that 2 GB is enough for Windows 7 and also installed their own "Media Center Experience" which starts up on boot and is written in .NET WPF, eating whatever RAM there's left? That one wasn't on the VAIO, it was on her previous HP laptop, but point still stands.
Yeah, maybe for a power user who built their own computer from scratch and did a clean install and carefully vetted every package as it was installed, sure, yeah nice experience. I have a Windows gaming box that is super lean and mean and it took a lot of effort to get it to this state.
But I still find myself scratching my head in disbelief every time a windows user tells me they need a new computer cause their existing one "just got real slow lately" even though they never touched the OS. And I know why it's slow too, I know before I even open it, dreading what I'm going to see in the notification area.
P.S. She's a very happy OS X user now, FWIW. One HP and one VAIO laptop later and another Microsoft ex-customer never coming back.
As for PDFs, Windows 8 and up come with a PDF viewer since, y'know, two and a half years ago when it was released. Did you miss that? Granted the default PDF viewer is a Modern App, but it works, and it works reasonably well. I use it regularly to dock a PDF on half of my monitor while I work on something else on the other side. Office, by the way, will read and write PDFs just fine, if you're after a more solid office-like product to do it. In case you're about to complain that Office is too pricey, LibreOffice will do the same. If an office-suite is not your speed, Sumatra PDF exists, and is free, open, has no bundling, and is available in a portable flavour.
Again, this is not Microsoft's fault. It is yours. No one is stuck in 1997 but you. You know what it requires to not be stuck in 1997? Any sort of intellectual curiosity at all.
> FUD? I deal with Windows issues from relatives on a weekly basis. What FUD? Am I imagining all of these issues? Spyware and adware infested boxes
See, you're doing it again. You're not dealing with "Windows issues", you're dealing with issues on Windows boxes, caused by non-Windows problems. These problems involve things like "my computer illiterate family really believed there was a Nigerian prince sending them email," they're not problems that Microsoft has introduced, and they're not problems that Microsoft CAN solve. Stupid people do stupid things, and one of those things is double-click PORNVIAGRA.EXE.
This annoys me so much because you are essentially arguing that problems caused by refusing to read are problems caused by operating systems, and this really isn't the case. This isn't something Apple has done a better job with either, it's just that the marketshare for Apple wasn't high enough for the malware vendors to bother with them. Notice how reports of Apple-specific shitware have increased in the past couple years with their marketshare? This should probably point out to you that it's not something that's solved by changing OS, it's solved by teaching your friends and family to be more tech-literate. You are arguing that the problem of pedestrians being hit by cars when they cross without looking will be solved if we just pad bumper of the cars enough. You want to try to find a technical solution to a human issue, which computers really aren't up to solving yet.
Don't get met wrong, there's stopgaps. There's services like http://unchecky.com/ which just uncheck all the checkboxes for you. Now you have checkboxes unchecked that you really need checked, and stuff doesn't get installed properly. There's still some reading required.
The point here, though, is that you're not an idiot. Your family aren't idiots. You're just all too lazy for your own good.
(As an aside, there's also valuable lesson in your post that Vaios are among the worst OEMs around. Don't buy Vaio.)
[1] http://www.microsoftstore.com/store/msusa/en_US/cat/category...
From the software developer angle, Windows is a FANTASTIC system when you need to get down to the nuts and bolts. People really need to educate themselves about the registry and the various ways the OS can be tweaked; as well as the various tools available (at a bare minimum those from Sysinternals).
Some other examples - the extensible kernel-level instrumentation that you get from ETW; the excellent crash and hang analysis tools provided by the likes of WinDbg (supported by the excellent debugging support in the Windows kernel -- yes, you can enable a keyboard shortcut that will memory dump your machine if it's hung and then it's a few commands to see what crashed); the commandline environment provided by PowerShell (I haven't used it much but really need to get into it more). Not to mention Application Verfier.
I could keep going on and on but it'd probably cloud my point if I haven't done so already :)
Not saying it's perfect or the be-all-and-end-all either; I also use all three major OSs, though primarily develop .NET software on Windows. Just frustrating that many of the complaints can be boiled down to "Windows doesn't work just like Linux/Unix does".
This is partially because linux is the dominant platform for Python developers, but developing/using Python libraries on Windows is really difficult. Many people simply overlook it.
The default command prompt is really really bad. There are alternatives, but none of them come close to the gnome shell. The Batch scripting language is terrible compared to Bash. Powershell is way too verbose and API-heavy. You can use Javascript, but then you are using Javascript... Then there are stability issues. I have left my home Linux computer on and online for months sometimes and never had any issues. Try the same thing on Windows... It will crash on the first week for sure.
The things Windows is great at is Office productivity software, gaming, design, and some other GPU-intensive tasks.
Desktop Linux is great at automation scripts, prototyping apps, temporary services for others (ssh and copy files), and virus-free internet browsing.
OSX is somewhere in the middle.
What is this, 1998?
Stability-wise my machines have actually been very good. I don't reboot much at all and mainly put the machine into suspend instead of turning it off. My first instinct/fear with a spontaneous BSOD now is that my RAM or HDD or something has gone bad.
Agree with you about development with things such as Python (though in that specific case I remember the Python Tools for Visual Studio being okay), or for that matter any new and upcoming language. My first thought when i want to try something like that out is to drop into Linux. It's just better supported for that kind of thing.
I love how you point at "unchecky" as a great service when it is a piece of software you use to deal with problems that shouldn't exist in other software.
How manu Windows users wailed and gnashed their teeth over iTunes insisting on installing Quicktime? Is that because Windows users are lazy or that they didn't want Quicktime installed just to use iTunes?
"You are all too lazy for your own good," is classic victim blaming.
Is it perhaps possible that Sony, Dell, Toshiba et al have poisoned the well?
If you have to carefully uncheck a bunch of options to avoid killing your computer with malware, then yes, the operating system is at fault. These sort of dark design patterns shouldn't exist, and the OS should be designed so that it's harder to implement shady things like this.
Yes, there is Mac malware out there, but Mac apps tend to have no installer at all, which is where most of the malware and crapware come from. It's harder to install some OS daemon when "installing" is just copying a file into your Applications folder. Mac apps almost never ask for permissions so I think users are more wary when the OS is asking weird stuff.
And Malware is practically unheard of in the Linux/Free Software world. I trust "apt-get install" implicitly when dealing with the main Debian archives.
> See, you're doing it again. You're not dealing with "Windows issues", you're dealing with issues on Windows boxes, caused by non-Windows problems.
That's a reasonable distinction, I suppose. How about this: The Windows software community sucks. The product may be fine if you know your way around the horrible alleys where malware and crapware lie in wait, but for normal people, the whole external environment is designed to screw you and mangle your computer.
Windows itself may be great, but the whole ecosystem is a wretched hive of scum and villainy.
I mostly agree, but there's still the fact that unlike in Windows I have to trust a randomer's ppa (or build from source, but that's sometimes pita and no-go for mortals) if I want to install the newest version of libreoffice or whatever, unlike in Windows where I can run binaries directly from the first party source.
I don't use Windows on my laptop, but I don't "hate" it, I totally concur on your point about people hating the platform for the wrong reasons, historically the maretshare of Windows has been high and that is the reason for malware stuff.
What irritates me more than people hating windows for no reason is they don't realize that they are not using the platform properly, for eg when I tell fellow developers to switch to or use Linux for development they "stick" to windows even if they can't change the brightness of the screen! Yes some stupid driver error, they say they are "comfortable" with Windows, but irnonically they can't even give folder permission to users, this basic thing!
I feel people are too resistant to change and they want to blame something/someone and that is the problem with the hate stuff that spreads like a flu over the Internet
You can't separate windows from its ecosystem - it's allegedly the choice of vendors and the availability of commodity hardware that makes windows at all appealing for most computer users. And the windows ecosystem sucks - it's full of weeds and parasites. Windows can't be examined in the abstract - if 99 out of 100 randomly chosen configurations in the marketplace are just terrible, then that's just Windows. It's the incredible leeway that Microsoft gives IHVs that makes Windows as popular and at the same time as terrible as it is. That's what characterizes Windows. As an operating system, it isn't half bad (it's architecture is quite good, actually) . As a platform, it's terrible.
See, you're doing it again. You're not dealing with "Windows issues", you're dealing with issues on Windows boxes, caused by non-Windows problems
What exactly is it that you're arguing? It seems like you and the parent are largely in agreement and you're trying to generate friction.
I would contend that you're right that it's absolutely true that with enough research and with constant vigilance, you can bring a retail Windows system into an acceptable configuration, have all of your hardware enumerating properly, and avoid malware.
I would contend that the parent is right that maintaining a Windows system is just barely worth it if it's your own machine and is a hopeless time-sink if you're doing it for free for anyone else, like family.
Are you two really just arguing past each other?
The point here, though, is that you're not an idiot. Your family aren't idiots. You're just all too lazy for your own good.
Please see the posting guidelines. Personal attacks are not acceptable.
He couldn't print his stuff for work. He called me up. After over an hour I gave up. Windows 8 couldn't figure out which drivers to use. The CDs attached with printer didn't help too. I mean the installation went smoothly, but then nothing was printed. Check your cables, etc. messages like we are still in 1996.
I don't have time for this BS. Drove back home, got my macbook pro. Came back to my Dad's home and did THIS: 1. connect printer to the mac 2. driver installs after clicking 'OK' or 'install', dont even remember at this point 3. print
that's it! Welcome back to 2015!
TL;DR: Printers still suck.
Or perhaps some form of scripting language that you could post, perhaps they could even call it PostScript?
You're actually proving his point : on Windows something as basic as reading PDFs (yes you "absolutely" need that in 2015) requires specific knowledge of obscure names like "Foxit Reader".
I'm not even going into annotating that PDF or adding your signature to it then.
The same goes for : an office suite, a file manager with decent previewing+smart search capabilities, something that quickly resizes/converts your pictures, great photo editing/cataloging software, video editing software, music editing software, e-mail client, a comprehensive development environment (1)
All of the above, which covers almost all areas of what people actually use computers for, comes as standard on OS X
(1) Pages/Numbers/Keynote, Finder+Spotlight, Preview (also your answer for annotating PDFs btw), iPhoto/Photos, iMovie, Garageband, Mail, Unix CLI/XCode
> Yes, you'll have to uncheck some boxes to avoid their bundled software. Big deal.
Hate to say it in troll-ish way but : everyone but lifelong Windows users has higher standards than this.
Hopefully the package manager in Windows 10 will offer up a happy medium between expected software being easily available, and 3rd parties not being pushed out of the market place.
Except that bundling itself is not what got Microsoft in trouble. Having a monopoly, and then taking a coordinated series of actions relating to conditions of sale, bundling, and other steps to extend that monopoly into other markets and to eliminate threats to the monopoly -- with evidence, including fairly explicit documentary evidence from senior decision-makers at Microsoft -- that that was the intent of the action is what got Microsoft in trouble.
They got in trouble under anti-monopoly laws, not anti-bundling laws.
I do agree that Microsoft did a whole boat load of other, really down right despicable, business practices as well. But in the MSN Messenger and Defender cases it was purely about shipping their own products preinstalled in Windows when competitors weren't included.
I guess you're right that my wording was perhaps a little too vague though. But my point was that when it comes to software bundling, Microsoft are damned if they do and damned if they don't.
Yes, if "bundling" is equivalent to threatening to "cut off Netscape's air supply", then, yes, "bundling" is exactly what got Microsoft into trouble.
Otherwise, no, "bundling" doesn't properly describe what happened.
Heck, do Chrome or Firefox actually register with the system to handle PDFs? Wouldn't surprise me if they did.
Don't forget about the 4 hours, 10 reboots, 3 blue screens, and reinstalling your video card drivers twice of windows updates!
On this very box, I bought a 8.1 pro license, and had to install drivers for my GPU (ATI r9), along with various other tidbits, which I've now forgotten. Oh, yeah, my usb sound card.
Granted, I needed to install the closed source drivers on the Linux side, but it was easier (enable non-free, aptitude install ...) -- and the soundcard worked out of the box.
At least the network card worked this time around on Windows (at least as far as I remember). So the only real hassle was that I needed a windows install from which to build the usb install stick. Thankfully I still dual-boot my laptop, so I could make the install image there.
This christmas. Building a new desktop for the first time in years. Bought high quality everything - Asus MB, Intel Quad core CPU, corsair memories etc. a fun and smooth experience.
I also bought Win 8.1 Pro, setup the machine for dual boot and then proceeded to install Win followed by Xubuntu. Gave me a good perspective on the state of the OSes.
Win install took much longer time, did not detect the AMD Radeon R9 card nor the Intel Eth interface on th MB. Or a lot of the peripherals. Using the supplied driver CD from Asus solved most of these, but not the GPU. To this day Win complains about some peripheral that it can't detect.
Xubuntu install was faster, smooth and did automatically detect all peripherals including Eth and GPU. And SW install using SW Center and Synaptic just works.
The Just Works used to be the perceived advantage of Win, and that Linux meant issues with drivers and fiddling with downloads from weird sites and manual builds.
It seems the world has flipped, mainly due to Linux progressing while Win really hasn't. Apart from the Metro/Modern interface that is there as well as the classic and you (read: I) end up being transferred between them.
FWIW the Signature series Wintel laptops sold through the Microsoft store are base Windows+driver builds, no crapware allowed.
Apple could easily write fully functional Linux drivers for their hardware if they wanted to, but they choose not to.
"Dude, get a Dell!"[1] Seriously, one of the selling points of a Dell system is rock solid components, and a centralized place to find drivers (at least for the business line of systems). Keep in mind, Dell sells hundreds of thousands (or more?) systems to corporate America, all with support contracts. Everything they can streamline and make more stable and reliable is money in their pocket. I mean, they wrote their own RAID drivers for the AMI and LSI Megaraid chipsets which they resold under the PERC brand, and in my experience, they were better than the manufacturer drivers. That takes dedication.
1: http://en.wikipedia.org/wiki/Ben_Curtis_%28actor%29#The_Dell...
Maybe I've waited long enough before moving. Especially now that this vuln is known about.
- My battery lasts longer, maybe 2-3 hours more per charge. I nearly never see < 50%, she's hitting 10% at the end of the day. (Note that both are good enough, but they're way different) - Mail search sucks on Yosemite. Today, we were searching for subjects that I know are there because I'm looking right at them, and nothing is coming up. - Safari does something funky with process per tab that manages to orphan process that take a bunch of cpu/memory. - Time machine is really touchy about backing up to the server over wifi. The last few times, it's had to make a new backup on the Yosemite machine. Mine misses a backup every day or so, but that's just an hourly miss, not a full rebuild.
We're considering blowing away her machine and pushing it back to mavericks with Time Machine/fresh install.
OS X has many merits on this front, but since 10.3 I've found that the first few dot releases of OS X have the same caveats often enough (both in terms of bugs/hazards and in terms of gratuitous UI "progress") that it usually seems better to wait past .x.4/5.
Now there's this, of course.
Since the problem showed up in 2011, maybe I should go back to Snow Leopard; I can't think of a single valuable change to OS X since then...
My reply to that has always been that Windows is only $300 if you don't value your time. (Preserving archaic cost of Windows to match JWZ quote.)
The implication that the one system is free and time-consuming and the other moderately in price but not time-consuming is entirely false. At the time, for many requirements, configuring and administering a Windows machine would have been more time-consuming than for Linux. It's also glossing over the fact that you can't horizontally scale your $-per-cpu/server solution once you do have the configuration worked out, without going back to the well for more money.
This amusing and glib quote also deliberately glosses over the "freedom" part of free software, which is essential. For example, I wonder if Google would exist today if not for a free unix workalike.
The sad truth is that most software sucks, regardless of the license, there's just a lower barrier to entry, use, and discoverability with OSS so it's more visible. At least with OSS we can fix the issues instead of just accepting the suckage.
After a year I find the only advantage of OSX are browser with touchpad gesture experience and windows edge handling. Haven't tried any distro ever since switching to MBP, wayland might have a better chance of replicating the experience. Hoping for the camera driver to be done.
In Linux everything else is better, fuller implementation of base tools, customizability, no crap like /var/folders..
This is entirely subjective; it is not a wise comment to make because it is better FOR YOU, not for everyone. For me, I liked the configurability in Linux desktop land but there comes a time when you want to sit in your office and get stuff done instead of spending all the time moving the furniture around and decorating; OSX doesn't let you do any decorating or move the furniture, so you're forced to do work (to some extent).
I daily use Linux, yet my day-job is to write software on OSX and Windows, so I get to use every system every day. They're all pretty much a muchness.
Great for servers.
Basically, each to their own. None is "better".
Haven't found that to be the case. And I'm an old UNIX hat, using SUN OS, HP UX et al in the early nineties and Linux from around 1998. My two observations:
1) Linux, even the most modern distro like Ubuntu, is a huge time sync for anyone that's not just content to browse the web and check mail in a system setup for them.
2) More users that we think are in that category (besides the proverbial "grandparents" perhaps).
You got a video from your wedding you need to edit? Might or might not work. You got a hobby that requires you to use a specific peripheral (like a soundcard) or software? Do you feel lucky? You got a new phone you need to sync? Prepare for an adventure...
1. "I need to do X in Linux." Web search for software.
2. Try to install it. Find out I need Gnome 3.44 and I'm not running Gnome at all.
3. Find something else. This doesn't seen Gnome.
4. I try to install it. Wait, I need a newer version of a library.
5. I grab the latest version of that library. Wait, idiot, that version is TOO NEW!
6. So I find the exact version and install it and oh son of a cow now everything is broken.
And at each step there's a different sub-community telling me I'm a complete idiot. ("Why don't you use Gnome?" "Why don't you use package manager X?" "Why the fuck are you using that package manager???!")
Yeah, like installing drivers for all your peripherals on Windows never takes time, right?
I wish I had that option, but I'm an iOS developer, so I upgrade when Apple forces me to, and right now their forcing Mavericks and up.
> Linux is only free if you don't value your time.
Amazing how the largest server farms on earth are all run by administrators who don't value their time...
But yes, the CLI is a requirement.
Actually, Windows isn't free for the companies who hire them. And you need to hire a lot more Windows admins than Linux admins if you want to keep your server farm running. But Windows admins are cheaper than Linux/Unix admins, so the phb can crow about that.
Used to say? How long ago was that?
Ubuntu and many other distros are incredibly easy and effortless to use. I know devs using apple products who spend more time mucking about with brew and other tools trying to accomplish things that are very easy to do on the most popular linux distros.
My point is that Ubuntu is complex [as is Windows] and when something doesn't run quite right, the right answer is usually hard to find and hard to recognize because it will be embedded in a culture of highly technical cross referencing. The tradeoff for going down the rabbit hole is that Linux is really powerful and flexible.
I'm loving me some Xmonad this week, but I had to root around in xkb and xmodmap and write a little haskell and read about out how to switch layout engines in Ubuntu [and then translate that into xfce based Ubuntu Studio]. It's non-trivial and requires reading stuff on the Arch Linux Wiki. Ubuntu isn't really self contained in the way Windows is.
Knowing that information about Ubuntu goes out of date and that changing the search criteria helps: [1] doesn't make Ubuntu less complex [2] prevents it from being as user friendly as Windows for a broad audience.
I don't use Ubuntu.
I have a USB disk with Snow Leopard on it that I can boot on my work's 2008 Mac Pro but that kernel panics on my 2012 MacBook Pro due to the i7 "from the future" according to Snow Leopard. It's a pity because it'd make a really great test system (I would like to check that my software runs on 10.6 OK).
Does anyone know of a way of booting Snow Leopard from disk inside a VM without many kernel kext kerfuffles? Parallels tells me that I stink if I try and install OSX inside it (I have the regular DVD, not the server edition)
Pity I can't actually boot it on my 2012 i7 (kernel panics ahoy).
If anyone knows how to get around this, I would appreciate it as it would be truly marvellous to be able to test software that I've written under it.
I was surprised just how well it's working tbh.
For us IT Shops, its almost exclusively about ensuring support for the hundreds of other software programs.
I see a lot of folks arguing otherwise, and I'm not sure they realize this.
Sure, it works fine for the 'isolated single user', but it's totally different in a large deployment model.
I generally put off doing a major Mac OS update for as long as possible.
Only 50% on Windows 7 or 8: https://analytics.usa.gov
Oh, wait, Windows 7 is from 2009. Only 10% use a Windows younger than two years.
Microsoft would not be able to get away with the shenanigans that Apple are pulling here.
The government is largely Windows PC's (mostly XP and Win7).
Unless your hardware has been made "incompatible" by Apple (not for any technical reason, but simply because they wish you'd buy new hardware).
It has a quad-core Xeon processor.
[update]
I am wrong. It is the late 2008 X-Serve that won't upgrade ...
Specs: https://support.apple.com/kb/SP10?locale=en_US
Supported H/W:
iMac (Mid 2007 or newer)
MacBook (Late 2008 Aluminum, or Early 2009 or newer)
MacBook Pro (Mid/Late 2007 or newer)
MacBook Air (Late 2008 or newer)
Mac mini (Early 2009 or newer)
Mac Pro (Early 2008 or newer)
Xserve (Early 2009)
At my last office we had older macs, a mix of laptops and desktops. They all ran slow, with one user's mac pro using all 4GB RAM on a fresh boot with nothing loaded. These folks were normal users, not power users. When a new OSX release would come out, a few people would upgrade, have a ton of problems, and warn everyone else.
I ran linux myself, and was occasionally called over to help with an OSX problem, and I could never understand how my colleagues could stand to work on such slow computers. In my experience, older macs do not usually run well on newer OSX.
My late 2011 13-in MacBook Pro became unbearably slow after doing a clean upgrade to Mavericks. Only upgrading the memory to 8GB (which was not supported by Apple for that model) fixed the issue. Yosemite works, but looks like crap on anything without a retina display. Newer versions of iOS have a habit of making older phones become sluggish when compared with the same phone model running an older version of iOS.
I'm not expecting Microsoft-level backwards compatibility, but as someone that has a somewhat complex development environment having to get everything to work on a new version of the OS can take up to a week of tweaking.
I've had little bugs and fiddly bugs with Safari and a few other things, but I really thinks it has worked fine for years and years on the machine. It noticeably improved when they added RAM compression (was that Mavericks?).
I don't find the graphics a problem at all, although they do look better on my Retina iMac. I got used to them pretty quickly.
I've been happy with most OS updates as they sped Safari up or fixed small bugs in it. Photos for OS X is a MASSIVE speed improvement over iPhoto.
I know some people run into pretty catastrophic bugs from time to time, I haven't had that experience personally. The idea that the OS doesn't run well on five-year-old hardware is bunk. I have no need to replace my MacBook Pro, The only thing it's not good at is 3D (and it was never very good at that).
If you have enough RAM and replace the spinning disk old Macs feel fantastic with a if you have enough RAM and replace the spinning hard drive old Mac still feel fantastic with a recent OS.
If you're on a 5400rpm drive with 2GB I'm sure it's painful. But I know even 4GB machines fair very well. SSDs just make an insanely big difference.
Upgrade was an easy drive pull and replace, and I just restored from Time Machine to get all my data back. No fuss.
But I don't have a windows partition or anything else special. I imagine it will be a bit more work for you since you'll need to backup the Windows partition and restore it.
I don't know any tech company that doesn't have that idea of a model customer :)
To their credit, I can run the latest on a pretty old Mac Mini at home. It's not as fast as it used to be, but it is supported long after the form factor of the Mini has undergone big changes. I don't consider myself being squeezed to upgrade.
Was it usable, speedwise, as a machine?
It worked with very little of the modern web, however.
We're talking about a security issue!
It's not only about support for "old" products, it's also about having a roadmap to begin with. It used to be common wisdom that Apple releases major updates for the current version of OS X, and security fixes for the last two versions. Well, that common wisdom is outdated now.
Also, backwards compatibility and security fixes are not really the same, and I'd say that the correlation between backwards compatibility and software quality is completely overrated. I know I'd rather trust my life to Windows 7 (the epitome of conservative OS design) than to OS X 10.10 or iOS 8 (speaking as an iOS developer).
In raw numbers, 45% of OS X users are now vulnerable (and probably don't even know about it), and Apple doesn't care. That's an insane number. And I thought not patching the ~10% iPhone 4 in the wild was dangerous!
An additional bonus is that you can get these things for free if you know where to look.
Of course, being 11 years old it also has its drawbacks. It won't fit more than 2GB of RAM. It is based around a single-core Pentium M which generally performs fine but shows its age mostly when meeting Javascript-hobbled web-related things.
BUT... and this is one of the main reasons why I use older hardware... if you develop software on this machine, and it works fine on that machine, it'll run circles around the stuff your neighbour made on his latest FlitzBang Fruitmachine. It'll but cause a blip on the CPU meter where his (or her, your choice) result maxes it out. It'll use memory like it was rationed, not like it was on sale.
Of course you can not develop software for the dark side on this older hardware. A small loss, in my opinion.
The majority of their user base doesn't know and wouldn't care about this type of thing even if they did.
Source: I'm a family "computer whiz" :/.
People understand if a system is insecure, and now apparently all non-Yosemite Macs are insecure. Folks will grok that. Whether or not they find out about it, well that's up to you and I, and everyone else on this website.
I agree it's up to us to proactively tell our parents, friends and colleagues who may be vulnerable about this problem.
https://support.apple.com/kb/DL1803 https://support.apple.com/kb/DL1802
from https://support.apple.com/en-us/HT204659:
> Admin Framework
> Available for: OS X Yosemite v10.10 to v10.10.2
> Impact: A process may gain admin privileges without properly authenticating Description: An issue existed when checking XPC entitlements. This issue was addressed with improved entitlement checking.
> CVE-ID
> CVE-2015-1130 : Emil Kvarnhammar at TrueSec
I can't really believe Apple will actually leave this unpatched, as opposed to just saying it won't at this time. The impact of this exploit and the number of affected systems is way too big, they really can't let this sit in OS X versions that were brand new only one or two years ago, that would be insane. With all the resources they have a statement like 'the impact of the changes would be too large' is quite ridiculous.
My guess is that they will patch it in a later update, but haven't finished it yet. Maybe they are even hoping for a few more people to upgrade to Yosemite before they release it. I would be willing to bet that they don't leave a gaping hole like this sitting indefinitely.
It would be an interesting exercise to try to figure out what made it easier to patch in 10.10. Is it because it is an active code base, or because something was refactored between 10.8/10.9 and 10.10 that eliminated the need to take advantage of this undocumented capability--for instance, something in the System Preferences getting refactored?
I notice that Windows 10 has had new bits shoe-horned in (a new settings screen!) whilst still keeping ALL the old stuff there (MMC as written in 1998? Control Panel is still there despite this new Settings page, duplication much? None of the icons match etc. etc. what a hodgepodge)
Ubuntu on a macbook pro is reasonably comparable. And the Dell offerings are looking damn good.
It would be nice to have a tiling window manager too.
I do think its too bad that setuid binaries don't have additional restrictions, like 100% must be code-signed or must be run in a sandbox-exec[1] based on that signing.
[1] - https://developer.apple.com/library/mac/documentation/Darwin...
But that's not really what you're asking for anyway. You can assign granular permissions to binaries regardless of code signing.
The real problem is there are so many things that aren't literally root but are effectively equivalent because if you can do them then you have easy privilege escalation. That's why the Windows security model is so silly. An administrator is not allowed to 'su' to another user without the user's password but any reasonable subset of the administrator's privileges can be used to silently cause any user to execute arbitrary code, e.g. by setting their login script or putting executables in the All Users startup folder or just loading a kernel driver that will let them do whatever they want.
Maybe, but the attacker can also get their certificate revoked when their activities are discovered.
It cannot simultaneously be easy for anyone to get a certificate and hard for an attacker to get a certificate.
That's like saying kernel memory protection is silly when the user is an admin because he could just as well load a driver into the system to wreak whatever havoc he wants.
Yes, he could. No, it's not silly.
If a user correctly has permission to do a thing via a series of ugly hacks then there is no reason not to just let the user do the thing directly.
- Start up the Mac whilst holding down ⌘-S. This boots the Mac into Single-User Mode and provides a method of interacting with OS X via the command-line, with full root privileges.
- Then check the filesystem to ensure there are no problems: "/sbin/fsck -fy"
- Then mount the filesystem for it to be accessible: "/sbin/mount -uw /"
- Now remove this file so OS X will re-run Setup Assistant: "rm /var/db/.AppleSetupDone"
Now just restart, and enjoy the cool introduction animation as you create your admin account.
Think hardware keyloggers, fake MBRs, &c.
OP's trick won't work, but that's an "implementation detail;" there are plenty others that will.
EDIT: to clarify; that's not what you said, it's just a common enough misconception that it's worth being explicit about, here.
If someone really wants to protect their data, they have to count physical access as a possibility and rely on encryption and/or remote wiping - the operating system login isn't going to do much anyway.
What's pretty bad here is that any user now has a backdoor to obtaining root privileges. That's an awful security flaw.
But yes, this is not possible with a firmware password or with disk encryption (FileVault) enabled.
Most OSX boxes are probably single user devices. But you do not normally run as root/wheel, you need sudo (sometimes through a nice GUI) for software to get root privs.
It's not 'somebody' as if another person were logged into their own account. It's that malware running as you can now get root, to further compromise your system, without needing a sudo password.
You still need to find a way to execute code on the target system (also called "getting a shell"), but this can be done over the wire, too.
So its really, really not good. Apple need to fix this soon, or else every OSX machine out there is going to start being targeted for misuse. This is really a powerful security bug.
Luckily after some digging I came across this fix and was back in to my computer, albeit a little shaken up by the back door.
What malware requires physical access? This is a local privilege escalation to root. It's only local because you need an account on the machine to make it work, but it can be bootstrapped to a remote exploit.
I really hate all the desktop IPC bullshit. IPC frameworks are pure fucking evil. COM, D-Bus, XPC, everything SUCKS.
If you want completely separate programs on one machine to talk, use UNIX domain sockets (with something like ZeroMQ or HTTP), FIFOs (named pipes), anything that you can chmod and chown, not a daemon that reinvents access control, badly.
This method wouldn't pass the most cursory of security checks. It's clear that it was never actually reviewed, and that the original programmer was relying on the proprietary nature of the OS X system for security. Something like this would never happen with Linux IPC - reviewing the methods published on dbus by services running as root by default is a basic check that any sane distro will do. Something as straightforwardly exploitable as this (literally just call the method while running as an admin user!) would never go in to Debian.
It's like users who encounter a random problem in a program, and then blame it on the fact that the program is written in C++, simply because they do not like C++.
> If you want completely separate programs on one machine to talk, use UNIX domain sockets
D-Bus does use UNIX domain sockets. Your ruthless hate should probably try harder at informing itself.
Right, so the simplest explanation is that it's an unintentional bug. The absence of evidence that it was unintentional isn't evidence that it was intentional. If there were some magic string or default password or something, that'd be an obvious backdoor, but to me this looks like a pretty typical privesc bug, albeit in an undocumented api.
It was found through a chain of events that started with looking at the patch related to another privilege escalation vulnerability, one which no one seems to be claiming was a backdoor.
> Also, waiting to fix it until a researcher makes it public may have been intentional.
I'm guessing it's more likely the the researcher waiting to go public until it was fixed.
This is evidenced both by the fact that it was patched alongside other vulns (ie. not a rushed out one-off patch) and from the article's disclosure timeline, which shows 'Full disclosure' occurring 04/09, while the 'Release of OS X 10.10.3' occurred 04/08. This is a pretty typical disclosure timeline; they couldn't begin to fix it until it was tracked as a bug, after all.
Yes, there is. Sue Apple for willful negligence and subpoena the development logs.
So, this was clearly intentional, because it's used by Apple directly. And it allows illicit access, because any program can use it to gain access.
Now, the fact that 'it takes too much effort' to backport would suggest that it was still in use. I don't see any other evidence, though. I'd be interested if someone found it!
systemsetup pointed to the Admin framework.
Admin framework analysis revealed use of "createFileWithContents". The function in which this use occurs is not named in the analysis.
An error message in the initial proof attempt led to "authenticateUsingAuthorization". Back to systemsetup to determine how to use "authenticateUsingAuthorization". (This is where I ended up mentally relinking the issue back to systemsetup.)
So, I concede that is is not stated where within the Admin framework this "createFileWithContents" method is invoked. However, I also agree that if that function was not used, it would be simple to remove it and the issue would be fixed.
If only it were that easy. Yosemite just seems to "break" some things and I've still been waiting it out.
I hate Apple's new yearly release cycle. There's not enough time to stabilize and improve OS's.
This update just rolled out, but it indicates the admin fixes are only for Yosemite:
https://support.apple.com/en-us/HT204659
How worried should I be about not having updated? There's still a risk I may lose some program compatibility by updating.
For a single-user desktop machine, realistically, user/root privilege separation doesn't matter, because all your important data is in your home directory and not protected by root privileges anyhow. The root-protected stuff is actually the stuff that's easiest to replace, because it's just a bunch of software that you can re-install. Viruses don't need to infect your software to stay resident; they can just as easily register a login hook without root permissions.
(That said, some people will violently disagree with me on this.)
> To be fair, OS X updates are free and usually run well even on 5+ years old hardware. OS X has kinda gone the way of Chrome, with most users on the newest version.
> While this is a significant vulnerability, I don't think the article is correct when it calls it a 'backdoor.' The term backdoor typically implies something that was intentionally left to allow illicit access, and while this is a significant bug, I don't see anything to indicate that's the case here.
> Title is a little generous about "hidden", the exploit revolves around API & Framework used to power the parts of the control panel, and its authorization scheme being broken.
> Smells like an oversight to me. Some new developer got assigned to implement or tweak the SSH enabling switch (or whatever), and this was their solution, which never got reviewed.
> Referring to Snow Leopard now not secure > Still pretty much the best OSX.
> Among other things upgrading (to 10.10.3) will do, it'll fix the issue in the article.
>Apple's model customer is one who upgrades often. If you want solid support for old products, stick with Microsoft, and accept that their products can be clunkier because of deliberate choices to maintain backwards-compatibility.
He was rebutting that regular upgrades are somehow a type of revenue to apple since they are free and work on some previous generation hardware. How is that apologetic?
A similar force seems to drive politics, or at least motivates disturbingly huge blocs of voters. :(
I don't like Apple's business practices, hard to hack devices and technology philosophy doesn't mean I am Tribal.
I have many machines that are over 5 years old.
I have never seen Apple as being honest or making products for me as a nerd. So I live mostly in Linux nowadays.
I have no credibility since I don't like a company? What about the opposite people who like the company?
Credible people are always upfront with their biases. I never trust anyone that says they are neutral.
Well the answer to that is when someone says something you call for proof. You don't throw out the baby with the bathwater. That's what I do with David Pouge and Walt Mossberg. But I usually get my news from Tech Press that has been black balled by Apple.
I don't intend that to be apologetic for Apple. I called it a 'significant vulnerability' but at the end of the day, it's a privilege escalation like those that have come before and will likely continue to be found occasionally, regardless of OS. I don't see what's apologetic about acknowledging a significant vulnerable while questioning whether it should be called a backdoor.
If you want to talk about Apple's response - I find it concerning that they aren't backporting the fix.
I don't see a single comment in this thread that says that.
It's dumbfounding how people here are simply shrugging this off and posting "So what? Just upgrade. Simples" type comments. This isn't acceptable. I know many people in creative industries alone who can't just upgrade immediately any time something comes out as they've to wait for their products to support the newer version. Similarly there are many who are using Macs in work whose corporate policies won't let them simply update immediately.
Then there's many who don't immediately upgrade versions as a point while bugs/other issues in that new version are found and resolved.
It's not an acceptable answer whatsoever.
Zero people is dumbfounding to you? Because that's how many people are saying that.
Reread the comments.
The second comment from the top when you go to
This is nothing close to "So what? Just upgrade." He's saying that from apple's perspective the best customer is one who upgrades their machine on every upgrade cycle which explains why they don't care about previous generation OSes. And how can you say this comment is apple-apologetic when he goes on to say that Microsoft does a better job maintaining backwards-compatibility?
The next one is a 3 year old Mac Mini. I upgraded to Yosemite and it performs TERRIBLY. It has 16G of RAM. I've tried everything. Yosemite just sucks. The machine is now much slower than the 6 or 7 year old iMac with only 4G or RAM. If it was practical to back out to Mavericks I would.
The last one is a 2 year old Macbook. I rely on it for my job. There is no way I'm going to risk the crappy Yosemite performance to upgrade. I'll live with the security flaw.
Here is what I now know about Apple: They will not support you for the lifetime of the product. They consistently release buggy code these days. Unless you are willing to shell out more money for new hardware every time they come out with something new, you will be stuck "as-is (with bugs)" until you get rid of it.
No more Apple anything for me. I'm thinking I'll switch the Mac Mini to Ubuntu if I can get it to work there. I'll use the iMac until it doesn't work any more, and when my Macbook is ready for an upgrade (in another year or two), I'll be trading in that still-Mavericks based system for a Linux laptop or maybe I'll go back to Windows.
I'd upgrade to Yosemite today with the latest updates. They just freed up 4 GB of ram for me. Sadly if I had known all of this beforehand I wouldn't have gone out of the way to buy some old Mac Pro where I could upgrade the memory to 32 GB or more, so I just wasted about $1500 for the whole setup.
Then again like you, I transitioned my work to an Ubuntu box, but even for my personal stuff my Mac was just really slow unless you get an SSD drive which is time consuming to install on an iMac.
For 2009 and up Mac Pros, there are plenty of hardware options for upgrades; and firmware as well for 2009.
We do not allow developers to criticize our revolutionary and beautiful platform. Good luck ever getting an app featured again.
- Apple
"Backdoor" isn't quite right, since that implies that the intent was to allow unauthorized use.
"Security vulnerability" isn't quite right either, since that usually implies getting code to exhibit some sort of behavior it was never supposed to have.
I can't think of any other term. Of the two, "backdoor" seems closer. Maybe "unintentional backdoor"?
Local privilege escalation. In a huge number of established LPEs, the exploit is by leveraging a weakness in checking who makes the call that allows legitimate privilege escalation. This is a legitimate privilege escalation (sshd binds to port 22, among others tasks), that can be exploited through a weakness in checking who is making that request and if they can have that granted.
(For values of 'nobody' which are not members of a set that includes such as Apple, obviously.)
Jargon and slang is needed for shortening the names of everyday things that people do, use or encounter.
If Apple has started a trend, we might need a new term, like "root kludge". A deliberate solution with negative attributes is a kludge (that much we have slang for, because we encounter such things with reasonable frequency). This type of kludge gets us root. So ...
Wait, if Apple starts a trend with this, then it will be cool, and have some name that begins with 'i'.
How about "iHole".
"An iHole was discovered in my wi-fi router's firmware".
Hmmm ...
To me the term backdoor implies malevolence and purposeful decision to allow you to remotely access someone's system without their permission later.
And purposeful decision to allow you to remotely access someone's system without their permission later.
This seems more like a mistake, although a pretty big one. It seems like it was designed as a small escaped out to make some of Apple's scripts cleaner it wasn't locked down to the degree that should've been.
It's a big security hole, but I'm not sure backdoor fits.
This is pretty bad, and trivially exploitable. Basically anyone that has non-root access to your computer can trivially become root and take over the system.
Case in point: Antenna gate, Bend-gate etc.
Programs crash for a reason! Crashing when faced with nonsense is a good thing! Let us not forget this.
The first thing objc_msgSend does is check if foo is nil and, if so, returns 0/nil/the all-zero bit pattern/whatever. It can be extremely convenient, but it can also be extremely inconvenient.
Anyway, I'll carry on reading my ObjC book as obviously the language has uses, although there's a Swift book in the post. Which do I read first though, eh?
(Of course, no compilers actually do precisely that, but it is possible for compilers to delete virtual method calls entirely if it can prove the receiver had to be null...)
class Example {
public:
static bool do_it;
virtual void do_it_if() {
if (g_do_it) return;
/* otherwise do something that dereferences this... */
}
};
void test1() {
Example::do_it = false;
static_cast<Example *>(NULL)->do_it_if();
}
void test2() {
Example::do_it = true;
static_cast<Example *>(NULL)->do_it_if();
}
EDIT:
Also, it's worth explaining why test1 works even though do_it_if is virtual. Since there aren't any methods that override do_it_if, the virtual method lookup can be elided and you don't have to dereference this to find the vtable. If do_it_if had been overridden and the runtime type was unknown, you would need to dereference this to lookup do_it_if in the vtable, which would segfault in both tests.
if (input == nil)
haltAndCatchFire();
I was imagining something more like a modified version of the runtime's objc_msgSend() C function (which Obj-C method invocations get compiled into) that guarded against that, but you do make me realize that such checks could conceivably be automatically tacked on at build time.
Anyway, I'm not entirely sure how useful such a thing would be, but I am curious how often my code (unintentionally) makes calls against nil and I've just never noticed because it doesn't cause harm.
Static analysis could potentially go a long way here to expose values that could be potentially "infected" with nil. (And, for all I know, the JVM JIT could do exactly this to skip checks on provably non-null values.)
I have a feeling it wouldn't work well in practice if you made the handler raise an exception. As the author notes, you're not the only one sending messages, and Cocoa will probably crash your program with a nil message send sooner or later. But you might be able to use it to find out where it's happening, at least.
(Note: I, myself, do not ever rely on this functionality, and even disagree with it, but the context in which people use it is important to understand when judging it; and with that context, I consider my own objections mostly due to my biases and not something that I would argue is "correct".)
>Philip tried patching that function (replacing sete with setne), with success:
How do you patch the binary without root or the admin user password anyway?
Hint: the first sentence you quoted ends with a question mark.
Sandboxed apps (from the app storr) may be blocked from doing this, I'm not sure.
Just tried. Sandbox lets this through. (As long as you pass nil to authenticateUsingAuthorizationSync:).
If you're a regular user of an OSX system before 10.10.3, and you want to become root (admin user), you can use this exploit to become root.
If you're an author of malicious OSX software, and a user without admin permissions installs your malware, you can use this exploit to make your malware run as root.
Once you have root, you can do anything on a system.
If the system you're attacking is 10.10.3 or later, you won't be able to use this exploit because Apple has a fix in 10.10.3.
Apple will not make the fix available to anyone on 10.9 or earlier.
Impact: A local user may be able to cause a system denial of service
Impact: A local user may be able to cause unexpected system shutdown
These two made me laugh though.
Quite a few other security related things are fixed with this update that do apply to older versions of OS X.
Lion was cancer.
Are you sorry you upgraded? (I'm asking for a friend.)
The only kernel panics I've experienced so far have been Parallels Desktop bugs that crashed the system. I'm regularly stressing my Macbook Pro to the max running vagrant images through Parallel Desktop with full integration tests running inside, and this tends to be pretty effective at finding strange bugs in Parallels Desktop.
http://www.amazon.com/Samsung-Portable-250GB-External-MU-PS2...
USB 3.0 is pretty fast. Without TRIM performance will probably degrade but that will take time.
I've managed to get it working after a fashion, although not reliably, and have come to the conclusion that Apple just don't do wireless well.