Apple password gaffe revealed by Adelaide Uni researcher

Powered by SC Magazine
 

Lion passwords can be cracked or changed.

An Adelaide security researcher has blown the lid on an explosive Apple OS Lion flaw that allows passwords to be accessed and changed by anyone.

The flaw exists in the way passwords are stored and accessed as encrypted shadow files.

These files are accessible due to flaws in the file permission structure that is designed to allow only authorised local users and administrators access to the shadow files.

But the oversight allows anyone to skirt the permissions by looking up password hashes for all users that were stored in directory services.

Passwords can then be brute forced, or simply changed.

Security researcher Patrick Dunstan, a senior security information specialist at the University of Adelaide revealed on his Defence in Depth blog that the flaw allows OS X user password hashes and salts to be parsed.

“It appears in the redesign of OS X Lion's authentication scheme a critical step has been overlooked,” Dunstan said.

“So for all modern OS X platforms (Tiger, Leopard, Snow Leopard and Lion) each user has their own shadow file (hash database) whose data is accessible only by the root user… or at least it should be.

“Obtain the user's GeneratedUID and then use that ID to extract hashes from a specific user's shadow file.”

The holes go beyond vulnerabilities revealed by Dunstan in 2009 that allowed passwords to be cracked only via administrative accounts on pre- OS X 10.7 systems.

Dunstan created a Python script to assist in cracking the SHA512 + 4-byte salt OS X Lion hashes.

He said users can mitigate the attacks by limiting standard access to the command line DSCL utility using:

$ sudo chmod 100 /usr/bin/dscl

Sophos senior consultant Chester Wisniewski recommened users change passwords, enable a screensaver password prompt, and disable automatic logon.

He said the capability to change passwords was "particularly dangerous" if Apple's FileVault 2 disk encryption was used.

"If your Mac were left unlocked and someone changed your password, you would no longer be able to boot your computer and potentially would lose access to all of your data."

More information is available on Dunstan's blog.

Copyright © SC Magazine, Australia


Apple password gaffe revealed by Adelaide Uni researcher
 
 
 
Top Stories
Business-focused Windows 10 brings back the Start menu
Microsoft skips 9 for the "greatest enterprise platform ever".
 
Feeling Shellshocked?
Stay up to date with patching for the Bash bug.
 
Amazon forced to reboot EC2 to patch Xen bug
Rolling restarts over next week.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Which is the most prevalent cyber attack method your organisation faces?




   |   View results
Phishing and social engineering
  66%
 
Advanced persistent threats
  5%
 
Unpatched or unsupported software vulnerabilities
  11%
 
Denial of service attacks
  6%
 
Insider threats
  12%
TOTAL VOTES: 1379

Vote