Apple password gaffe revealed by Adelaide Uni researcher

By Darren Pauli on Sep 21, 2011 9:46 PM
Filed under Security

Lion passwords can be cracked or changed.

An Adelaide security researcher has blown the lid on an explosive Apple OS Lion flaw that allows passwords to be accessed and changed by anyone.

The flaw exists in the way passwords are stored and accessed as encrypted shadow files.

These files are accessible due to flaws in the file permission structure that is designed to allow only authorised local users and administrators access to the shadow files.

But the oversight allows anyone to skirt the permissions by looking up password hashes for all users that were stored in directory services.

Passwords can then be brute forced, or simply changed.

Security researcher Patrick Dunstan, a senior security information specialist at the University of Adelaide revealed on his Defence in Depth blog that the flaw allows OS X user password hashes and salts to be parsed.

“It appears in the redesign of OS X Lion's authentication scheme a critical step has been overlooked,” Dunstan said.

“So for all modern OS X platforms (Tiger, Leopard, Snow Leopard and Lion) each user has their own shadow file (hash database) whose data is accessible only by the root user… or at least it should be.

“Obtain the user's GeneratedUID and then use that ID to extract hashes from a specific user's shadow file.”

The holes go beyond vulnerabilities revealed by Dunstan in 2009 that allowed passwords to be cracked only via administrative accounts on pre- OS X 10.7 systems.

Dunstan created a Python script to assist in cracking the SHA512 + 4-byte salt OS X Lion hashes.

He said users can mitigate the attacks by limiting standard access to the command line DSCL utility using:

$ sudo chmod 100 /usr/bin/dscl

Sophos senior consultant Chester Wisniewski recommened users change passwords, enable a screensaver password prompt, and disable automatic logon.

He said the capability to change passwords was "particularly dangerous" if Apple's FileVault 2 disk encryption was used.

"If your Mac were left unlocked and someone changed your password, you would no longer be able to boot your computer and potentially would lose access to all of your data."

More information is available on Dunstan's blog.

Follow us on Facebook and Twitter

Copyright © SC Magazine, Australia


Apple password gaffe revealed by Adelaide Uni researcher
Top Stories
Award winners from the 2015 CRN Fast50
[Photos] See who picked up a prize at the awards last week.
Hills chief: transformation cost us customers, staff, revenue
Will "get back to basics" after tumultuous years.
The red carpet at the 2015 CRN Fast50
[Photos] The nation's best resellers celebrate.
Sign up to receive CRN email bulletins
Was your most important vendor the same in 2015 as in 2014?

Latest Comments
CRN Magazine

Issue: 343 | October 2015

CRN Magazine looks in-depth at the emerging issues and developments for the channel, and provides insight, analysis and strategic information to help resellers better run their businesses.