Latest Version of OS X Closes Backdoor-Like Bug that Gives Attackers Root

For at Least 4 Years, a Bug in Apple's OS X Gave Untrusted Users — and Possibly Remote Hackers with Only Limited Control of their Target — Unfettered "Root" Privileges over Macs. The Vulnerability is Being Called a "Hidden Backdoor" by Emil Kvarnhammar, the Security Researcher Who Discovered the Bug and Privately Reported it to Apple. It's probably More Accurate to Describe it the Equivalent of an Unpublished Programming Interface that Allowed Users with Admin or Even Lower-Level Standard Privileges to Gain Root. The Privilege Escalation Flaw was Fixed in a Massive Security Update Apple Released Wednesday for the 10.10, a.k.a. Yosemite, Version of OS X. Macs Running Versions 10.9 or Earlier, Remain Vulnerable. "The Admin framework in Apple OS X contained a hidden backdoor API to root access for several years (at least since 2011, when 10.7 was released)", Kvarnhammar Wrote in a Blog Post Published Thursday. "The intention was probably to serve the 'System Preferences' app and systemsetup (command-line tool) but, there is No Access Restriction. This Means the API is accessible (through XPC) from any user process in the system." To Fully Exploit the Bug, Attackers would Need Physical Access to the Targeted Mac.


But, the Escalation Vulnerability could Potentially be Exploited Remotely in Combination with Other Attacks, for instance, One that's Able to Compromise a Browser and Break Out of its Security Sandbox but, Doesn't Have Privileged Access to Operating System Resources. Exploits Might also be Useful against Machines Running Server Versions of OS X. When Kvarnhammar 1st Discovered the Bug Last October, he Found he could Exploit it to Gain Root Privileges from the Rights Normally Granted Only to Admin Accounts. The Researcher Continued to Experiment with the Flaw until he Found a Way to Elevate Privileges Even from Standard OS X Accounts, which Give Users Considerably Less Control. To Kvarnhammar's Amazement, he was Able to Expand the Attack by Sending a What's Known as a "Nil" to the OS X Mechanism that Performs the Elevation Authorization. A Nil is a Zero-Like Value in the Objective C Programming Language that Represents a Non-Existent Object. "It seems like the authorization checks are made by triggering callback functions on the auth-object supplied", Kvarnhammar Wrote. "For those of you who are not Objective-C programmers: Guess what happens if you call methods on a null reference–or to use Objective-C language, send a message to nil ? Nothing ! :)"




Info Sources:

http://prod.lists.apple.com/archives/security-announce/2015/Apr/msg00001.html

https://truesecdev.wordpress.com/2015/04/09/hidden-backdoor-api-to-root-privileges-in-apple-os-x

http://en.wikipedia.org/wiki/Objective-C