Re:Hiding malware in Windows: The basics of code injection
by saagarjha on Friday September 21, 2018 @11:58AM
(#18040622)
> Mac OS is the only mainstream OS I know of that disallows debugging by non-root user accounts entirely.
This isn't true; Xcode works just fine on non-root accounts. You will need to get permission to debug anything from an admin user, or add yourself to the developers group. And if you want to debug a system binary you'll need to disable SIP.
Re:Hiding malware in Windows: The basics of code injection
by blincoln on Friday September 21, 2018 @01:00PM
(#18041054)
> Xcode works just fine on non-root accounts
Are you sure that attaching to a process (for debugging/memory-modification) in general does on modern versions of Mac OS?
"In order to guarantee support for debugging on the Mac, you need to log in on the Developer Tools Access dialog box using the administrator or root user password" [1]
"DTrace requires admin privileges" [2]
[1] http://docwiki.embarcadero.com/RADStudio/Tokyo/en/Acquiring_...
[2] http://dtrace.org/blogs/brendan/2011/10/10/top-10-dtrace-scr...
Re:Hiding malware in Windows: The basics of code injection
by saagarjha on Friday September 21, 2018 @01:31PM
(#18041266)
That's consistent with I'm saying. You do not need to be root to attach to a process on macOS; you merely need to be part of the _developer group. I believe admins are added to this group by default, but you can do it manually if you wish. If you don't, you'll need to type the password of an admin user before you can debug anything.
Re:Hiding malware in Windows: The basics of code injection
by blincoln on Friday September 21, 2018 @03:12PM
(#18041937)
Unfortunately, I don't have access to a machine to test with - my statement was based on a lengthy discussion from a few months ago at a previous job - but I'll assume you're correct, and amend my original statement to "Mac OS is the only mainstream OS I know of that disallows debugging by non-privileged user accounts entirely." Thanks :).
Linux used to be similar (and I think some distributions still are), but is now slightly more restrictive, in that processes running as non-root user accounts can only debug child processes they've launched, as opposed to other processes running under the same user account. It can still be used for hiding extra code, of course.
Mac OS is the only mainstream OS I know of that disallows debugging by non-root user accounts entirely.
Think of it this way - on a shared system (e.g. a Linux server) how would developers debug their code in e.g. gdb if they couldn't attach to a process that they'd launched, and interact with it at a low level? Apple can avoid supporting that scenario because they no longer sell systems intended for use my multiple people at the same time, and a developer on a Mac will have sudo permissions as root.