macOS High Sierra Bug Lets Anyone Gain Root Access

 
Hi guys hope you are all keeping well, and if not I am yet again going to drain the brightness from your day. If you own a Mac computer and run the latest version of Apple's operating system, macOS High Sierra, then you need to be extra careful with your computer. Apparently anyone and I mean anyone from your two year old to your grandad can break into your mac device and become a superuser. Yes I said it, a superuser a god of elevated privileges a root to all evil, only the geeks in the room will get that one. So here's the thing Apple are calling this a bug when they should really just come out and say:

 "look guys we turned on root to do some shit, then we kinda forgot to turn it off, and, em, looks like that's the image we used to roll out 1,000s of machines on, our bad.....
PS the iPhone X is great you should go buy one it comes with enhanced features like stealing your key biometrics data for facial recognition so the CIA don't have to." - This may or may not have been a statement made by Apple T&C's apply.

Here's How to Login as Root User Without a Password

If you own a Mac and want to try this exploit, follow these steps from admin or guest account:

• Open System Preferences on the machine.
• Select Users & Groups.
• Click the lock icon to make changes.
• Enter "root" in the username field of a login window.
• Move the cursor into the Password field and hit enter button there few times, leaving it blank.

With that macOS High Sierra logs the unauthorized user in with root privileges, allowing the user to access your Mac as a "superuser" with permission to read and write to system files, including those in other macOS accounts as well.

This flaw can be exploited in several ways, depending on the setup of the targeted Mac. With full-disk encryption disabled, a rogue user can turn on a Mac that's entirely powered down and log in as root by doing the same trick.

At Mac's login screen, an untrusted user can also use the root trick to gain access to a Mac that has FileVault turned on to make unauthorized changes to the Mac System Preferences, like disabling FileVault.

All the untrusted user needs to do is click "Other" at the login screen, and then enter "root" again with no password. However, it is impossible to exploit this vulnerability when a Mac machine is turned on, and the screen is protected with a password.

I suppose there is no point in doing the scary dance without having a solution to hand and just as easy the potential to carry out this exploit the fix is similarly as simple to fix just follow the steps below.

Here's How to Temporarily Fix the macOS High Sierra Bug

To fix the vulnerability, you need to enable the root user with a password. Heres how to do that:

• Open System Preferences and Select Users & Groups
• Click on the lock icon and Enter your administrator name and password there
• Click on "Login Options" and select "Join" at the bottom of the screen
• Select "Open Directory Utility"
• Click on the lock icon to make changes and type your username and password there
• Click "Edit" at the top of the menu bar
• Select "Enable Root User" and set a password for the root user account

This password will prevent the account from being accessed with a blank password.

Just to be on the safer side, you can also disable Guest accounts on your Mac. for this, head on to System Preferences → Users & Groups, select Guest User after entering your admin password, and disable "Allow guests to log in to this computer."

Are your keystrokes being recorded?

It's always nice to set the scene for these subjects it helps my over active imagination to write better, so lets sit back and imagine the following: you are browsing the internet, firstly you look up a few weird and wonderful subjects, then you tip over to that dodgy website your wife doesn't know about to catch up on that online affair you have been having. You ask how did you know? well if you have been watching any tech related news in the past week you would have seen a headline or two stating things like "popular sites record your every keystrokes" and the rest.

So you ask what does that mean, websites are recording my keystrokes so they have a bulk file filled with code and text and links right?  Well technically yes but someone also though it would be a good idea to create a software that plays back all of this stuff in a film like format, sound scary? well it is and as you can see from the video below were your "keystrokes" to get leaked you might be in a whole pile of doo doo pretty quickly.

Researchers from Princeton University's Centre for Information Technology Policy (CITP) analyzed the Alexa top 50,000 websites in the world and found that 482 sites, many of which are high profile, are using a new web-tracking technique to track every move of their users.

Dubbed "Session Replay," the technique is used even by most popular websites, including The Guardian, Reuters, Samsung, Al-Jazeera, VK, Adobe, Microsoft, and WordPress, to record every single movement a visitor does while navigating a web page, and this incredibly extensive data is then sent off to a third party for analysis.

"Session replay scripts" are usually designed to gather data regarding user engagement that can be used by website developers to improve the end-user experience. However, what's particularly concerning is that these scripts record beyond the information you purposely give to a website—which also includes the text you type out while filing a form and then delete before hitting 'Submit.'

If your starting to get cold sweats after reading the above then here are a couple of sites where you can educate yourself a bit further on this topic.

https://thehackernews.com/2017/11/website-keylogging.html

https://thenextweb.com/security/2017/11/21/hundreds-of-websites-record-your-every-keystroke-without-you-knowing/

https://www.dailydot.com/debug/websites-record-keystroke/

Security Meets Cost

I was recently asked by a small business how could they secure their IT on a budget this made me stop to think about that tricky subject "security meets cost". It is in these terms that a business must be practical, you need to stand back and identify your actual financial loss were a cyber attack or unforeseen event to occur resulting in the loss of data. And to be quite honest if your spending thousands on perimeter controls and don't have anyone in your business who can properly configure, monitor and maintain these devices then your really just throwing money down the drain.

After going through the business I advised them to put in place a number of steps that would go a long way towards protecting them. It must be noted that the business in question did not deal with any payments card information (PCI), personally identifiable information (PII) or personal health information (PHI) if your business is dealing with the above then you will need to put more controls in place.

My plan for the business was pretty simple and I will lay it out below.

1) Education:
This is one of the fundamental roles that small businesses neglect, there are hundreds of services out there that will do training days on different areas in an easy to understand and education manner. If you can train staff to identify Phising, Smishing and other everyday threats then you are starting to win a war on the front line. Education helps get employees to think before opening an attachment or giving out "harmless" information over the phone. For the more adventures small business there are packages available for you to run harmless attacks that contain educational videos when clicked. PhishMe would be one such company that comes to mind in that regard.

2) Backups:
This one is quite simple but often forgotten, with the rise of ransomware every small business should keep daily or weekly backups. These backups should be occasionally tested to ensure that they can restore systems in the event of an emergency such as a ransomware infection.

3) Business Continuity Plan:
 Every business should have one and should test it, you can work on building this up over a period of time but you need to start somewhere. EG. if the building floods are our desktops on the floor? Maybe we should elevate them to mitigate this problem. During this flood do employee have the ability to work from home? Yes we have remote access to the building over our companies VPN.

The above are just suggestions but you get the drift if you start to disect your company and compare it to potential events you might be surprised what you come up with. Fail to prepare then prepare to fail.

4) Virus and Anti- malware protection:
Again this is simple but neglected in many small businesses, buy a good antivirus and anti-malware package and set the updates to times you know your employees wont shut them down eg lunch time or after working hours. A good antivirus and malware solution is like having a security guard in your network throwing out all the bad guys.


5) Enable Bit-locker or the equivalent:
Bit-locker encrypts your disk so if someone breaks in and robs your physical machine in theory bit-locker will keep that information safe, unless of course the thief is Homeland security or the equivalent in which case your data is the least of your worries.

6) Password Policy:
Put in place a robust password policy that includes the rotation of passwords regularly and password history check to prevent the re-use of passwords.

7) Third party checks:
If you are using a third party to store data or to provide remote support ask them to provide you with a list of controls that are in place to protect you from a security point of view. If they tell you they are super secure and you need to trust them get worried because this means they haven't got anything to give you and your cloud solution is some guy with a laptop and 15 housemates that use it to stream illegal movies.

8) Document everything!
You should document all of your procedures and workflows because if one guy has all this information and gets hit by a bus your knowledge is dead. Good documentation is key to smooth transition and helps aid security through clarity.



If you get all the above in order you will have made a decent move towards securing your business at a minimal cost, of course there is plenty of room to do more but the hardest part is always to make a start.

Securing your iPhone 5 +

As the title suggests for this post I am just focusing on the iPhone 5 and up. For the most part Apple are pretty slick when it comes to patching their devices and keeping things secure, however a lot of the features of the iPhone that may make your life a bit easier may also create an area of insecurity around your device. Lets take siri for example, shes great to have a chat with on cold nights when there is no one else around. The issue with siri is she's a bit of a gossip and will talk to anyone. Let's take the following scenario your phone is stolen, you have a lock code on it so even though your pissed your not going to panic just yet. Lets say who ever stole your device has been watching you and they want to find out where you live, they cant do that right? WRONG if you have spent a bit of time setting siri up chances are she can be accessed from the lock screen of your phone, so all our thief/stalker needs to do is ask siri a few simple questions.


Who am I?

Where do I live?

What are my upcoming appointments?


Try this yourself see what information you get back....


Am I starting to paint a picture of how this can all go wrong so fast..... Hold on just before we start to panic I have created a list of 10 things you can do to help protect yourself and your family. Of course you can completely ignore my list and keep living life on the edge if that's your thing :).

1) Disable Siri on a lock screen

Go to “Settings” –> “Passcode” (or “Touch ID and passcode”) –> “Allow access when locked” section –> “Siri: off” and “Settings” –> “General” –> “Siri” –> “Allow “Hey Siri”: off”.

2) Use a strong password instead of a 4 digit code

This is important I cant stress enough, how simple it has become to smash out your 4 digit passcode in a few hours. You might think who the hell would bother doing that I'm not some Government spy no your not but you do have lots of juicy personal data in their that can be used to steal your identity or exploits your friends and family. As an extra option, you can also turn the “erase data” feature on, so the device will wipe everything from its memory after 10 failed passcode attempts. But keep in mind that all the data will be erased forever and you won’t be able to recover it i.e DON'T FORGOT YOUR PASSWORD!!!!!

Where can you set these requirements? Go to “Settings” –> “Passcode” (or “Touch ID and passcode”) –> “Require passcode: immediately”; “Simple passcode: off”.

3) Turn off lock screen notifications

This is similar to the stalker/possible killer type scenario or just the nosy work colleague keep your shit private! The more information you allow to your screen the more exposed you are, you may not think that matters until you are sitting in the pub and your friend sends you a message to ask: "is that asshole Dave there?", and you can then respond saying "yup hes here and by the way he read the message cause I let my phone display everything to the screen.... sorry plus Dave said he wants the €50 he lent you back!".... Maybe that's exaggerated but don't take any chances.

Where can you set these requirements? Go to “Settings” –> “Passcode” (or “Touch ID and passcode”) –> “Allow access when locked” section.

4) Turn on two-step verification for Apple ID and iCloud

This is a big one, in my opinion it will only be a matter of time before every device that requires a log in will force people to use two-step verification, but just in case I'm wrong you should set it up anyway. Apple makes you wait a few days before you can actually set this up so if you start the process don't forget to log back in and finish it off after.. 3 days I think.

Where can you set these requirements? Go to https://appleid.apple.com –> “Manage your Apple ID” –> “Password and Security” –> “Two-Step Verification”.

5) Turn off automatic sync to iCloud

This is one of those things that could really come back and bite you in the ass literally! If you have iCloud set up you have 3G/4G or wifi and you take a picture boom its in the cloud... FOREVER!!! So I don't know but I'm guessing after a crazy night out you may want to review what picture leave your phone and head off to god knows where.

Where can you set these requirements? Go to “Settings” –> “iCloud”.

6) Turn off cookies in your browsers

Your now thinking "cookies" what the hell is this guy on about there is no "cookies" in my phone, I can't dip this thing in tea! No you cant and please don't try your phone won't taste great it will just stop working. Cookies are small files which almost any website generates and leaves on your device. They may contain some information about you, your computer or smartphone, and your preferences. It helps websites keep you logged in, or to show you some relevant content including ads, but in some cases they may be very helpful to cybercriminals as they can contain credentials and other sensitive data. The only issue here is some site just wont work when you disable this so its one of those catch 22 situations.

Where can you set these requirements? For Safari: Go to “Settings” –> “Safari” –> “Privacy & Security” section –> “Do Not Track: on”, “Block Cookies: Always Block”; For third party browsers: see similar browser settings.

7) Don’t let apps access your contacts, photos, messages and other private data

This is one of my pet hates, when I download an app for getting dinner recipes why the hell does it want access to my contacts, my camera and my microphone???? And secondly why would anyone allow it access to any of these things? This really is one that you should spend a bit of time looking into.

Where can you set these requirements? Go to “Settings” –> “Privacy”.

8) Turn off the AutoFill option in your browsers

This is another of those be less lazy common sense type things, if this feature is turned on and someone gets your phone chances are they will be able to log into a number of sites..As you!

Where can you set these requirements? For Safari: Go to “Settings” –> “Safari” –> “General” section –> “Passwords & AutoFill”; For third party browsers: see similar browser settings.

9)Discard automatic WiFi connections to known networks

I don't like this feature at all, and I'm going to tell you why. By having this enabled your phone will not only automatically connected to any wifi network that you logged onto before, but it will also log onto any network with the same SSID (name) of a network that you logged on before. This is dangerous, think of shopping areas that offer public wifi (which of course you wouldn't use because your smarter than that) most of these networks have the same name a common one in Ireland is "eircom". Therefore your phone will automatically connect to these networking if you ever connected to one of that name before, so I really shouldn't have to explain why this can be a fruitful play ground for a cybercriminal.

Where can you set these requirements? Go to “Settings” –> “Wi-Fi” –> “Ask to join networks: on”.

10) Get used to VPN

A VPN or virtual private network is the best way to go to really ensure some safety when browsing the web especially on those public wireless networks that you would never use. There is also no point going for a free VPN as the speeds and reliability and all that other stuff that you don't really understand wont be great. You can make up your own mind on who to go with for this I use AirVPN they charge around €30 for 6 months with unlimited bandwidth.






So guys, that's it for today if anyone has any questions post them below and I guarantee to get back to you within one working year.