Mac OS X hackable with application installer?

[MrFrankly]

Mac Geekery has an article about how it's potentially possible for installer applications to do root privileged operations without prompting the user for a password.

This means that it's possible for an installer to install a backdoor on your Mac without asking you for a password like it should do normally when performing root-only operations.

Because this is the standard setup of Mac OS X this could be considered an implementation mistake from Apple. Users expect to be prompted for a password when root privileged actions have to be made by an installer. But with relative ease installers can choose not to prompt for a password, leaving users unaware that the core of their system is being altered.

The Mac Geekery article has more details and a better description of the problem.

 

[JDN]

What are root privileged actions?? Sorry, im a newbie.

 

[Shadow]

What are root privileged actions?? Sorry, im a newbie.

Well, root is the super-duper user of *NIX systems, so they are actions that require the root user to do. Things that will alter the OS, stuff like that.

Bow down before me, for I am ROOT!

 

[benthewraith]

Mac Geekery has an article about how it's potentially possible for installer applications to do root privileged operations without prompting the user for a password.

This means that it's possible for an installer to install a backdoor on your Mac without asking you for a password like it should do normally when performing root-only operations.

Because this is the standard setup of Mac OS X this could be considered an implementation mistake from Apple. Users expect to be prompted for a password when root privileged actions have to be made by an installer. But with relative ease installers can choose not to prompt for a password, leaving users unaware that the core of their system is being altered.

The Mac Geekery article has more details and a better description of the problem.

Doesn't OS X decide what's a threat and what's not. It doesn't ask for a password when installing Firefox?

So I guess we'll be seeing another security update sometime soon in 10.4.8.

 

[iMeowbot]

Doesn't OS X decide what's a threat and what's not.

Not really. It ultimately relies on the good intentions of programmers. Installers don't have to really tell you what they are doing, and no security update is going to be able to change that in a bulletproof way.

It doesn't ask for a password when installing Firefox?

Firefox doesn't use an installer, you simply copy the application to your disk.

I'm not so sure that a password prompt will make that much of a difference, since users are already conditioned to enter those for installers.

 

[Demoman]

After reading the article it seems to be a self-fulfilling prophecy. If, if, if.....
The perp still has to become the root user, and the user has to virtually open the door for them to do so.

 

[MrFrankly]

After reading the article it seems to be a self-fulfilling prophecy. If, if, if.....
The perp still has to become the root user, and the user has to virtually open the door for them to do so.

Yes, but basically this is the same situation where Windows always get burned for. Users running as admin is dangerous. But with Windows the solution (run as) doesn't really work. Mac OS X however does have a perfect working solution available already. You only need to have a seperate admin user and a normal working account and then you will always be prompted for the admin password at the right situations. So there is a good, safe and workable solution available but it simply isn't used in a default installation.