Can't Hack a Mac!

[macjack1]

You have to be running an account that has proper permissions to overwrite the executables with a malicious copy first. But even then, most of the time it'll still only execute with your ID, which worst case is part of GID 80 which is required to authenticate prior to escalation to root.

Even running in a non-admin account would make no difference. In the example I gave, this is an app that you want to download. So you would switch to admin, authenticate and download it.

I'm not saying that a developer would put malicious code in their app. After all, they are out to sell their software and make a good name for it. What I'm saying is to be sure to download only from trusted sites. You don't know who's tampered it along the way if you download from PTP or even from mirrors. In fact, downloading virus definitions from ClamX, which uses many mirrors, could be more possibly a risk than not running it. (an extreme example, granted)

Your example barely touches the surface. Go and read up MOAB 15.

My example barely touches the surface intentionally. I wouldn't want to give any ideas to blackhats who may be lurking.

I'm aware of MOAB and many other proof-of-concepts that have been thwarted by Apple with updates and security patches. MOAB is a proof-of-concept that can reset permission bits and gain access to root.

But my point is that access to root is not necessary to get everything of value off your your Mac - as in identity theft. Again, I can replace a system but I can't replace a stolen identity.

But, I think we are both preaching to the converted?

-mj