iOS Privacy: Easily get a user's Apple ID password, just by asking

Re:iOS Privacy: Easily get a user's Apple ID password, just ... by slrz on Tuesday October 10, 2017 @03:07PM (#15444466)

> But few are in the practice of doing that.

Because there's no point. If I'm able to manipulate your shell environment to set aliases, I can also change your search path so that \sudo picks up the program I want. And no, you can't defeat that by only running /usr/bin/sudo because there are a million other nasty things to do once an attacker has reached this level of control.

[ Parent | on HN ]

Re:iOS Privacy: Easily get a user's Apple ID password, just ... by seiferteric on Tuesday October 10, 2017 @04:10PM (#15444965)

I'm sure there are plenty of tricks. I could be wrong, but I think the \ is a shell builtin thing, so I don't think creating a \sudo or the like would work. You could set the PATH and put a fake sudo in a secret directory in there that precedes the /usr/bin/sudo though, so that would be a problem.

[ Parent | on HN ]

Re:iOS Privacy: Easily get a user's Apple ID password, just ... by shabble on Tuesday October 10, 2017 @05:07PM (#15445323)

untested, but I think you could possibly bypass it with a malicious .inputrc binding for <enter>, although making it conditional such that it only removed a leading \ could be tricky.

In Bash there might also be a way to do something cunning with a 'trap DEBUG' hook to modify the command between submission and it actually being run.

Or you could just exec into a terminal multiplexer like screen[1] to intercept & rewrite/suppress both commands and output.

Edit: It's much easier than that.

The function:

    echo () { command echo "hax" $@; }

will still be called by '\echo test' (The 'command' prefix stops it becoming a forkbomb :)

[1] or maybe just hijack stdin/out FDs from the shell?

[ Parent | on HN ]