News for hackers. Stuff that matters.

A comment on IOHIDeous OS X Local Kernel Vulnerability. Parent comment

Re:IOHIDeous OS X Local Kernel Vulnerability by Siguza on Sunday December 31, 2017 @10:14PM (#16044459)
Needs to be running on the host already (nothing remote), achieves full system compromise by itself, but logs you out in the process. Can wait for logout though and is fast enough to run on shutdown/reboot until 10.13.1. On 10.13.2 it takes a fair bit longer (maybe half a minute) after logging out, so if your OS logs you out unexpectedly... maybe pull the plug? And maybe don't download & run untrusted software until the bug is patched (or, you know, ever)? Also, any decent antivirus shouldn't take long to add this to their malware definitions.

Not sure if this is HN-level, but... I hope it's understandable.

[ Parent | on HN ]
Re:IOHIDeous OS X Local Kernel Vulnerability by antaviana on Monday January 01, 2018 @04:48AM (#16045470)
Indeed, I always buy iMacs instead of MacBooks because I can actually pull the plug whenever something takes longer than anticipated.
[ Parent | on HN ]
Re:IOHIDeous OS X Local Kernel Vulnerability by tomduncalf on Monday January 01, 2018 @07:33AM (#16045828)
You can just press and hold the power button to shut a Macbook off. I assume this is a hardware level interrupt as I’ve never seen it fail. Granted not quite as satisfying as physically pulling the plug!
[ Parent | on HN ]
Re:IOHIDeous OS X Local Kernel Vulnerability by bluedino on Monday January 01, 2018 @07:44AM (#16045862)
When they had power buttons you could
[ Parent | on HN ]
Re:IOHIDeous OS X Local Kernel Vulnerability by jsmthrowaway on Monday January 01, 2018 @11:09AM (#16046556)
They still do, it just also does Touch ID now. Source: Have one.
[ Parent | on HN ]
Re:IOHIDeous OS X Local Kernel Vulnerability by zulln on Monday January 01, 2018 @10:33AM (#16046399)
It should not be too hard to build in a hardware-switch. Sure, it would take some time but think I would prefer that over always being stationary.
[ Parent | on HN ]
Re:IOHIDeous OS X Local Kernel Vulnerability by sigjuice on Monday January 01, 2018 @05:00AM (#16045491)
Pulling the plug is a bit extreme. Perhaps you might consider logging on from another computer to troubleshoot?
[ Parent | on HN ]
Re:IOHIDeous OS X Local Kernel Vulnerability by geekamongus on Sunday December 31, 2017 @11:26PM (#16044696)
> Also, any decent antivirus shouldn't take long to add this to their malware definitions.

Have Mac users finally started running antivirus?

[ Parent | on HN ]
Re:IOHIDeous OS X Local Kernel Vulnerability by j0hnml on Monday January 01, 2018 @12:23AM (#16044838)
Apple actually creates some signatures in house with “XProtect”, but I’m not sure they do the same for raw privesc exploits. I’m also not sure how thorough they are with their signature creation...
[ Parent | on HN ]
Re:IOHIDeous OS X Local Kernel Vulnerability by Siguza on Sunday December 31, 2017 @11:49PM (#16044758)
Well, that I don't know...
[ Parent | on HN ]
Re:IOHIDeous OS X Local Kernel Vulnerability by oneplane on Monday January 01, 2018 @10:25AM (#16046359)
Some of them. But mostly of prevent forwarding windows-malware. Most corporate-managed stuff has endpoint protection, and most end-users are covered by GateKeeper, XProtect and the standard Google safe browse whatever it's called thing. And since most of the basic users simply use webmail, that vector is covered as well. It's not as bad as it once was.
[ Parent | on HN ]
Re:IOHIDeous OS X Local Kernel Vulnerability by biehl on Monday January 01, 2018 @04:25AM (#16045408)
No
[ Parent | on HN ]