A Backdoor in Skype for Mac OS X

Re:A Backdoor in Skype for Mac OS X by pvg on Tuesday December 13, 2016 @12:27PM (#13168585)

That is not at all a realistic interpretation. This is an 'authentication bypass' for a Skype API for locally executed code. Any even slightly serious attacker who has got to that point has already won - they don't need a 'Skype backdoor'.

[ Parent | on HN ]

Re:A Backdoor in Skype for Mac OS X by MichaelGG on Tuesday December 13, 2016 @12:52PM (#13168812)

Are Mac OS apps unable to debug other applications or generally mess with their process space? If so, like on Windows, then this API is basically a courtesy and not a real security boundary in the first place.

[ Parent | on HN ]

Re:A Backdoor in Skype for Mac OS X by pvg on Tuesday December 13, 2016 @01:30PM (#13169223)

I'm really just going by basic idea that once an attacker can run arbitrary code on your desktop, it's game over. That attacker doesn't gain anything by engineering and organizing some 'backdoor' into Skype, they've already owned you.

[ Parent | on HN ]

Re:A Backdoor in Skype for Mac OS X by bonzini on Tuesday December 13, 2016 @01:15PM (#13169035)

There is some basic sandboxing, for example a debugger cannot attach to a running copy of iTunes (but you can start it under gdb and bypass the call that enables the sandbox).

[ Parent | on HN ]