Local privilege escalation is always bad because it means you're one malware payload or RCE away from being rooted and conscripted into someone's botnet (or worse). This isn't just a physical access concern.

What about without local privilege escalation? Is there no way for a malware payload or RCE to turn your computer into a botnet without root privileges?

There certainly is, but rooting a box lets you ensure that you stuff says in place. Once a box is rooted, its owner can never really be sure they have it clean without wiping and rebuilding it.

There are advertising networks that use JavaScript on client machine do distributed computing. Is that a botnet or not?

Do you know where I can observe this? I'd like to review the code.

Even easier is running 'resetpassword' from Terminal in Recovery mode (boot with ⌘-R). This gets you a nice GUI tool where you can reset any account passwords.

But yes, this is not possible with a firmware password or with disk encryption (FileVault) enabled.

Not possible if full disk encryption is enabled. And that is a default since a year or so.

full disk encryption only protects you from passive snooping. If someone has physical access between two of your subsequent uses, no amount of any type of encryption will save you. Except maybe some entangled quantum bit collapsing mechanism. Maybe.

Think hardware keyloggers, fake MBRs, &c.

OP's trick won't work, but that's an "implementation detail;" there are plenty others that will.

EDIT: to clarify; that's not what you said, it's just a common enough misconception that it's worth being explicit about, here.

Of course keyloggers etc. are a problem. But that is a different story. A bug which can be exploited just by grabbing any device might have a larger impact on the vendors reputation. A keylogger, fake smc, whatsoever ist much more dangerous for a single person, because the attacker knows what he wants on the specific device.

There's have to be a hardware mod if a firmware password is enabled. It prevents booting from any other media or partition without a password.

That's not very interesting. You can do the same on a linux box, passing init=/bin/sh in the boot loader, and probably the same on windows (boot a WinPE CD or a Linux live CD with NTFS3g).

If I understood the article correctly, this can be exploited remotely by anybody who has managed to get a shell on the system.

It's even worse than it seems if you talk about it as 'anybody'.

Most OSX boxes are probably single user devices. But you do not normally run as root/wheel, you need sudo (sometimes through a nice GUI) for software to get root privs.

It's not 'somebody' as if another person were logged into their own account. It's that malware running as you can now get root, to further compromise your system, without needing a sudo password.

Just to clarify, this is _not_ a remote vulnerability. If it was a means to create a remote shell, then it would be. An attacker would need to first find some way to gain remote access and then could use this bug to gain root privilege.

The parent comment and some of the child comments are implying you need to be physically near the system, which doesn't seem to be true.

You still need to find a way to execute code on the target system (also called "getting a shell"), but this can be done over the wire, too.

That's how all local exploits work.

Yes, but that's not really a concern. Physical access with no disk encryption is always 'vulnerable'.

What's pretty bad here is that any user now has a backdoor to obtaining root privileges. That's an awful security flaw.

There's a huge difference between physical access vulnerabilities (which are basically impossible to prevent) and local privesc vulnerabilities (which can be exploited in software).

To exemplify, for instance, this vulnerability could be packed in a phishing mail executable giving the remote attacker root access if the user falls for the trap, no?

It could be packaged into any executable that someone might think about downloading off the Internet for some reason.

So its really, really not good. Apple need to fix this soon, or else every OSX machine out there is going to start being targeted for misuse. This is really a powerful security bug.

Yes.

Isn't the idea though that with physical access, the game is already over anyway? If an intruder has physical access to your machine they will eventually be able to get to anything they want.

If someone really wants to protect their data, they have to count physical access as a possibility and rely on encryption and/or remote wiping - the operating system login isn't going to do much anyway.

Yep, physical access is total access. However, this trick falls under cool-at-school-tech-labs, I'd hope enterprise systems would do something to prevent this kind of low-level shenanigans.

School tech labs are modelled after the enterprise networks, the only difference is usually a bit more competent IT staff. I'd expect most of the school-lab tricks to be directly transferable to enterprise.

> With physical access

What malware requires physical access? This is a local privilege escalation to root. It's only local because you need an account on the machine to make it work, but it can be bootstrapped to a remote exploit.

About two months or three ago I stupidly changed my password to my only account to a password I promptly forgot. I was losing it when I realized what I had done. To make matters worse, I did this change a day before our office was scheduled to move to automated backups via Time Machine.

Luckily after some digging I came across this fix and was back in to my computer, albeit a little shaken up by the back door.

If you're paranoid enough to think someone you don't trust can have physical access to your Mac, it is possible to prevent this by setting up firmware password though.

See https://support.apple.com/en-us/HT204455

Firmware passwords can be bypassed by a local user with a Thunderbolt Option ROM. The 10.10.2 fix for Thunderstrike left that hole open during normal boots: https://trmm.net/Thunderstrike_FAQ#Is_Thunderstrike_fixed_in...

The first Mac I ever got, the IT department forgot to give me admin access, so I couldn't install any software. Having never used a Mac before, it took a grand total of about 15 minutes of Googling to figure out how to boot into single user mode and give myself admin access.