What is Digg?88 Comments
- McGrude, on 10/12/2007, -2/+23Unforunately that includes many people. Why else do you think there are so many lame computer users (of any OS).
- shark615, on 10/12/2007, -5/+22Welcome to 99% of Windows exploits!
Because nobody ever downloads those smiley packs or animatd monkeys! - strcmp, on 10/12/2007, -1/+16@Odweaver
Wrong, admin accounts *are* the default on OS X. - Sutoka, on 10/12/2007, -1/+13'Admin' accounts on OS X aren't the same as 'admin' on windows or 'root' on all unix platforms (including OS X). 'Admin' accounts on OS X are closest to a Linux user account in the 'wheel' group (having access to use sudo/su to do things as root). Also the default account on OS X is setup as an 'admin'.
- WackyT, on 10/12/2007, -11/+23"because mac users aren't idiots"
You're definitely not watching the same Apple ads I've been seeing then. Being able to make a picture book or vacation video doesn't make you computer literate. - intent, on 10/12/2007, -6/+16I think he's being sarcastic...
- ahknight, on 10/12/2007, -0/+6Running an installer isn't jumping through hoops, it's a standard activity. And how many installer packages do you actually know and trust, really? As the article says, even Parallels uses this ability to install kernel extensions without your password. Kernel extensions. It could be wiping your drive during "Optimization" and you'd never know.
- inkswamp, on 10/12/2007, -6/+12Boy does this gets tiresome.
Who says they have no flaws or security issues? I've never heard a single Mac user say that. What is commonly said (because it's true) is that there are no security issues that have been exploited to allows viruses or other nastiness to run rampant on OS X the way you see happening on Windows. Only the biggest idiot would say OS X has no security issues.
So, take your strawman argument and go somewhere else if you can't discuss things in a civil and reasonably factual manner. - Obvioustroll, on 10/12/2007, -4/+9People can mock, but the Installer is a huge vulnerability for Apple and a perverse exception to their normal rules for user interaction.
Biggest problem - it doesn't provide an automatic uninstall, and it should. Second problem - it can require the user to type the admin password.
In Apple's defense they've been telling developers not to use Installer and to go to a strict drag-and-drop install model. - AhronZombi, on 10/12/2007, -6/+11unfortunitly most mac users are just as blind as windows users. but the diffreance is mac users down know they are blind so they walk off ledges. windows users just sit back and tremble at the sight of the internet
- redxii, on 10/12/2007, -6/+11Buried as 'Blasphemy'.
- satansbanjo, on 10/12/2007, -2/+7@ mddleNameIsEarl
That's the problem - Macs have a hugely divided audience. There are the hardcore Apple geeks who have been on through the rough days of OS X (and before) and know all about what to do with a Mac, then there are the people who switch to a Mac for simplicity as well as security. The latter group will probably stay with the Administrator account it created by default because they won't notice a difference. When I first got my MacBook Pro, I stayed with the Admin account just thinking along the lines of what I was taught by Windows, thinking that as a non-admin user I wouldn't be able to change many preferences. Now that I've installed loads of software on my Admin account (and I don't know how much of it is user-specific or for all users) I don't really want to go and create another account. I guess I'll just digg this story and hope Apple picks up on it so they can release something with the next Tiger update (there hasn't been one for a while...) - Obvioustroll, on 10/12/2007, -1/+6Unfortunately, no it does not.
Believe me, I've written OS X code professionally. The installer can write files all over your system, and it will leave behind a file that looks like the original install file but is really just a "receipt" that lists the files that were installed - but it won't uninstall them.
For most end user applications Installer isn't needed - as you say, the correct way for a "real" OS X application to be installed is you drag it from the DMG file to /Applications and you uninstall it by dragging it to the trash. But even that leaves behind the application's preference files and so on - there has been talk of writing a shareware tool that will hunt down and kill old Library and Preference files for deleted applications but I don't know if anyone has actually done it. - pyrates, on 10/12/2007, -3/+8You think sony would have put an installer like this for the sony root kit? You bet. That way it be just like windows. So call it what it is.
Then again, you need to be running as an administrative user. Which is the default in mac os x. Not the same in windows. In windows however you're running as root. In mac os x, administrative user is just below root. And this security hole leaves it wide open. It needs to be fixed. - ahknight, on 10/12/2007, -0/+4An admin in Mac OS X is a member of the wheel group. That's it. Otherwise, it's the same user.
- ahknight, on 10/12/2007, -0/+4/etc is a symlink to /private/etc/, dolt. It does the same thing because Installer follows symlinks.
I tried it. It works. - spectre_25gt, on 10/12/2007, -0/+3I fail to see how linux is any harder to use than Windows or OS X. It's the configuration that is problematic for the most part.
- spectre_25gt, on 10/12/2007, -0/+3When a password prompt comes up on OS X, it's an indicator that something big is going to happen to your system. When you see that, it's time to stop and think twice about whatever is goign on. Without that password prompt, people are much more likely to install software that they may not really want.
- Sutoka, on 10/12/2007, -1/+4"Administrator" accounts on OS X are NOT the same as an "Administrator" account on Windows or 'root' on any other OS. The "Administrator" accounts can simply use a sudo or su like interface (and have the user prompted for their password) to elevate the program's privileges. The default account on OS X is also setup as an 'Admin'.
The 'admin' account is supposed to be similar to a regular linux user account thats in the wheel group/has access to sudo. - spectre_25gt, on 10/12/2007, -0/+3It should be pointed out, however that an admin != root on OS X. There are many things that an admin needs to su to do. This is definitely a hole and I'll be interested to see how Apple handles it.
Edit: Damnit, wrong reply. My reply was for Daldredge's thread. - pattersonb, on 10/12/2007, -0/+3it's called appzapper. you can get it from http://www.appzapper.com for $12.95 with lifetime upgrades.
- eyechart, on 10/12/2007, -4/+7did you even rtfa?
This is definitely a vulnerability - and I am a mac user. This is the kind of thing that gets exploited. - DKasler, on 10/12/2007, -5/+8Hello. I'm a PC, and I am a Mac.
We both crash, we both get hacked, we both get viruses. we both suffer from design flaws... - sc0tt, on 10/12/2007, -1/+4There is, its called ZapIt or something similar. Works really well too!
- buzzert, on 10/12/2007, -0/+2AppZapper (http://appzapper.com/)
Who cares about preference files though? They're not that big.
EDIT: Darn, you beat me. - ahknight, on 10/12/2007, -9/+11When it dies, go here:
http://www.macgeekery.com.nyud.net:8080/tips/security/how_a_malformed_installer_package_can_crack_mac_os_x - inactive, on 10/12/2007, -2/+4If you have kept viruses out I would have dugg you up.
- ahknight, on 10/12/2007, -4/+6Because 90%+ of Mac users run as the admin and don't know enough to actually do it safely.
- shark615, on 10/12/2007, -5/+6Again the majority of popular Windows hacks require the user to accept and install said program or at least ignore a warning. The number times I have watch people click yes or ok without reading the warning scares me.
Why is it different if the same process is on a Mac? - Twango, on 10/12/2007, -0/+1"90%+ of Mac users run as the admin and don't know enough to actually do it safely"
And where does that statistic come from? "Common sense"??? - doce, on 10/12/2007, -0/+1@neko:
no. being an "admin" in OS X is more like being in the Wheel or Admin group of another unix, and _should_ still require a password to perform root actions. - porkstacker, on 10/12/2007, -1/+2Simple solution, even stated within the article:
“do not install packages from non-reputable sources”
Can I get a “DUUUUUUUUUUUUHHH!!!” from the crowd tonight?!?! - phlame, on 10/12/2007, -13/+14The think the point here is that a user has to jump through hoops in order to get "hacked".
"Look guys! I found out that if I jump off the roof of my house, I break my legs! My house is so insecure."
Same thing.
This would only be a large issue if the installer could run remotely without me doing anything, like all those windows worms. Nothing to see here kids. - Obvioustroll, on 10/12/2007, -1/+2Excellent. I'll have to look for it.
- ahknight, on 10/12/2007, -2/+3Yes.
- nd_miller, on 10/12/2007, -3/+4This is blasphemy!
Macs are impenetrable fortresses of design over function. - hcsteve, on 10/12/2007, -3/+4I think a lot of commenters are missing the point of this exploit. First of all, you're right, running as an administrator on Windows or root on most linux distros is a bad idea. However, the security model of OS X is supposed to make it safe to run as an administrative user, because the system is supposed to prompt you for your password before performing any action that requires "root" access. In this case, a certain setting in an installer package allows the package to have "root" access _without_ first prompting for a password. And supposedly, this behavior is by design. If that's true, this is a major failure by Apple. I'm a proud mac user, but I know a problem when I see one.
- DelMonte, on 10/12/2007, -2/+2Yes this is a vulnerability and should be patch this soon BUT:
1. If you reach the point where you decide to install an application on your Mac, it means you are likely to enter your admin password if asked to, and potentially allow this app to take control of your computer even after rebooting.
2. This security hole can only happen through the standard OS package installer. The installer will pop up at least one dialog box asking the user to accept or decline the installation. Even a malformed .pkg cannot skip this dialog.
3. So that means THIS HACK REQUIRES USER INTERACTION, and more than simply opening the application: the user has to accept one or many dialog boxes that specifically ask the user if he wants to install something. Even if the package was opened in an automatic way, the user still can click cancel.
At this point, if a newbie accepts the install, he'd probably type his admin password anyway is asked too.
It doesn't change much that most Windows malware are installed with user interaction:
People that often install stuff from untrusted sources on Mac OS X don't even think twice about typing their admin password in an installer, so they are not more vulnerable because of this security hole.
The important thing here is that OS X will still warns you and give you the possibility to cancel at every occasions where something will be installed in the System folder and/or other protected directories.
This method doesn't provide a way to make a file/application that can gain root/admin privileges by doing nothing more than opening it.
Only sarcastic Mac-haters say that the Mac is invulnerable.
There are many factors that explains why Mac OS X didn't have a single working virus in its 5 years of existence.But wether it's because of low market share or security aspects or both, these factors aren't gonna disappear all of a sudden. Even if it was only because of market share, it couldn't rise fast enough and get big enough to create a sudden explosion of viruses on the Mac.
Maybe because of the smaller marketshare, the Mac/Apple news network is very tightly knit. MacSurfer.com acts as a hub for the Mac news since the beginning of the web. Mac users established Mac news networks early on in the web history.
This means that if a single working virus appears on the Mac, the news of it would spread like fire, much faster than the virus itself. A temporary fix would be found in a few hours, and be quickly spread around too, even before security companies react and before the virus does starts to spread.
The Mac community is ready to take down real threats, one by one, while the Windows community has its hands full, many stopped caring, they just run their anti-virus without participating in getting rid of threats. Don't assume Apple and Mac users would let these things escalate like Microsoft did with Windows. - macbruiser, on 10/12/2007, -0/+0in relation to AppZapper, check out "AppDelete" (you can get it for free on osx dowloads page)
simple drap an apps icon over the appdelete icon and it trashes the application directory and
any related files, you can review the files it deleted before emptying your trash...
worked pretty good for me. - SuperFarStucker, on 10/12/2007, -3/+3If these claims are in fact true it is a grave charge indeed. Workable access controls are often touted as one of the features that makes OS X and Linux resistant to exploits. Want to make a change to the system's internals? You're going to need the password for that. Well all that goes out the window with this, though it is likely to be quickly patched as it seems a trivial fix which would have no negative consequences. However, since the installer would seem a likely attack vector and this a careless oversight it does raise questions as to what other holes are undoubtedly lurking within Apple's software suite.
- Sutoka, on 10/12/2007, -1/+1Actually this isn't like running as root on linux, this is like running as a linux user that can use sudo or su.
- LocoMan, on 10/12/2007, -6/+6What's more... I remember a mass mailing worm not too long ago that came as a passworded zip file (to avoid detection since AV programs can't check zip files without the password), and the password came as a string of 4 numbers attached as an image file... so basically an user had to read the password, extract the zip file, input the password (no copy/pasting since it's not in text mode but on an image file), then run the extracted exe... you'd think that with such a convoluted process it would never spread.. yet back then I got like 3 or 4 messages with this every day for about a week, so there were people that ran it.
One question, it says there that OSX creates an administrator account in the beginning and most users run from it.. is that true?... I ask because the macs we use at work ask for the administrator password anytime I try to install something, but not sure if that's how it is by default or if something was configured differently from default when setting it up. - omaryak, on 10/12/2007, -4/+4The question is: do novice Mac users know how to expand a disk image as easily as a Windows user could run an executable file? And because most Mac installations do not require an installer, would they run an installer for an obscure program without hesitation?
- neko, on 10/12/2007, -1/+1If i've understood it correctly, it means authenticating as Admin is equivalent to authenticating as Root, which is Bad.
Not quite as bad as, ... random example.. oh, I don't know, Windows XP Administrator privileges, where every action goes unchecked, the default users in OS X are "potential administrator" users, they have to type in a password in order to escalate their privileges temporarily. Bit like how ubuntu sets the first user up in the adm group, and doesn't use a root password but lets them sudo up with their own password.
But still, I'm a bit disappointed in OS X. There I was thinking they had a cool 3-tier system going, root access (no-one should ever need) admin access (use temporarily for installing software) and bog-standard users. But it seems the first two are equivalent, because of the flaw the article talks about. - grabraham, on 10/12/2007, -3/+2Unless I am really missing something.. the issue is that the installer escallates to Root without requiring the root password NOT that running as root allows root access;
- tolldog, on 10/12/2007, -4/+3This is an interesting situation.
Its exactly why people aren't supposed to run in windows as admin or log in to your linux system as root, unless you need to do a specific task.
I was waiting for a good reason to not run as an admin level user on my OSX system. Now, I have one.
Maybe the default setup should not give admin privs. It would just make the "it just works" part of the Mac a little more difficult. - manitoba98xp, on 10/12/2007, -7/+5Am I the only person who doesn't consider this a serious vulnerability? If you've downloaded and launched an Installer package, you're probably going to enter your password at the prompt anyways. I think this should be fixed, but I wouldn't consider it serious.
- redxii, on 10/12/2007, -5/+3Many Windows users think running as non-admin means to be treated like an idiot and be protected from themselves. These same people choose to run 3 or more "security" apps in the background and misc other on-demand scanners. I only run AVG and non-admin.
- eyechart, on 10/12/2007, -5/+2if you don't realize that this is a bit of a problem, then you are an idiot.
anyone can upload a package to a website and call it whatever they want. Who doesn't want to download the latest mactheripper, or the universal binary updater for photoshop, etc.
it would be so easy.
btw, DTJunkie07, my earlier comment wasn't directed at you. I blame the wonderful commenting features of digg.. -
Show 51 - 88 of 88 discussions
Check out the new & improved 
© Digg Inc. 2009
— Content created and posted by Digg users is