Tag Archives: Security hole

AMD RyzenFall, MasterKey, Fallout, Chimera Mitigation Guide

Leave a reply

The recently-discovered RyzenFall, MasterKey, Fallout and Chimera security flaws affecting AMD’s latest processor platforms are ruining the AMD Ryzen 2 pre-launch vibes. So it’s no surprise to see AMD working hard to fix the vulnerabilities.

In this article, we will share with you the latest AMD mitigation options for the RyzenFall, MasterKey, Fallout and Chimera security vulnerabilities.

 

What’s Really Affected?

While it is accurate to say that the AMD Ryzen and AMD EPYC processors are affected by RyzenFall, MasterKey, Fallout and Chimera, these vulnerabilities do not affect the actual processor cores. Neither are they related to the Zen microarchitecture.

This makes them completely different from the Meltdown and Spectre vulnerabilities that have been “built into” over 2,800 CPU models!

Instead, the new RyzenFall, MasterKey, Fallout and Chimera security vulnerabilities are found in:

  • the AMD Secure Processor (integrated into the new Ryzen and EPYC processors), and
  • the AMD Promontory chipsets that are paired with Ryzen and Ryzen Pro desktop processors.

The AMD Promontory chipset is used in many Socket AM4 desktop, and Socket TR4 high-end desktop (HEDT) platforms.

AMD EPYC, Ryzen Embedded, and Ryzen Mobile platforms do not use the Promontory chipset.

 

The AMD RyzenFall, MasterKey, Fallout + Chimera Mitigations

RyzenFall + Fallout

Issue : An attacker with administrative access can write to the AMD Secure Processor (PSP registers to exploit vulnerabilities in the interface between the x86 processor core and AMD Secure Processor.

Impact : The attacker can circumvent security controls to install difficult-to-detect malware in the x86 System Management Mode (SMM). The access is not persistent across reboots.

Planned Mitigations : AMD will issue AMD Secure Processor firmware patches through BIOS updates in coming weeks. No performance impact is expected.

MasterKey (PSP Privilege Escalation)

Issue : An attacker with administrative access can write malicious firmware updates, without the AMD Secure Processor (PSP) detecting the “corruption”.

Impact : The attacker can circumvent security controls to install difficult-to-detect malware. These changes are persistent, even following a system reboot.

Planned Mitigations : AMD will issue AMD Secure Processor firmware patches through BIOS updates in coming weeks. No performance impact is expected.

Chimera

Issue : An attacker with administrative access can install a malicious driver to access certain features in the AMD Promontory chipset.

Impact : The attacker can access physical memory through the Promontory chipset. The attacker can also install difficult-to-detect malware in the chipset, but this is not persistent across reboots.

Planned Mitigations : AMD will issue chipset patches through BIOS updates in coming weeks. No performance impact is expected.

 

Reading Suggestions

[adrotate group=”2″]

Go Back To > Guides | Home

 

Support Tech ARP!

If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!

Apple Rushed Out macOS Root Bug Fix & It Shows…

1 Reply

Lemi Orhan Ergin did not give Apple any forewarning when he publicly revealed the massive macOS root bug on Twitter. He basically exposed a zero-day vulnerability for hackers to use, while Apple rushed on a bug fix. The good news is Apple just issued the root bug fix in Security Update 2017-001.

This is really fast work, but it also showed their sloppiness. Hopefully, the bug fix does not introduce additional bugs!

 

macOS Security Update 2017-001

[adrotate group=”2″]

Apple released macOS Security Update 2017-001 just a day after the macOS root bug was revealed. They also gave us more information on the bug that caused so much ruckus around the world (and rightly so).

  • The bug only affected macOS High Sierra 10.13.1.
  • The bug did not affect computers running macOS Sierra 10.12.6 or earlier.
  • They confirmed that it allowed an attacker to “bypass administrator authentication without supplying the administrator’s password“.

You can get more details on the root bug in our dedicated article – The macOS High Sierra Root Bug Explained!

 

How Do I Download The Root Bug Fix?

The macOS root bug fix is now available for download via the App Store. If it doesn’t appear yet, just click on the Updates icon to refresh.

Please note that this bug fix will reset and disable the root user account.  If you need to use the root user account, you will need to re-enable it, and change its password, after applying the update.

 

Terminal Users, Watch Out!

If you’re using Terminal to update though, you may face some complications due to Apple’s sloppiness. Chai discovered that Apple accidentally used a space instead of the version number.

This is not an issue if you are downloading the patch through the App Store. But if you’re applying the patch via Terminal, you need to add a space.

softwareupdate -i “Security Update 2017-001- “

Go Back To > Articles | Home

 

Support Tech ARP!

If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!

The macOS High Sierra Root Bug Explained! Rev. 2.0

3 Replies

The Internet is abuzz with the shocking revelation that now everyone can hack an Apple computer… as long as it’s using the latest macOS High Sierra operating system. Let us explain what’s going on, and share with you the workaround for the macOS High Sierra root bug.

Updated @ 2017-11-30 : Added a new section on the Apple bug fix (Security Update 2017-001) [1], and additional information on the root bug [2].

Originally posted @ 2017-11-29

 

What Is Root User?

If you are the primary user of a MacOS X system, you have an administrator account with administrator privileges. This gives you more privileges and access than a standard user account. However, that is not the highest access level possible.

There is a Mac superuser account called “root” that gives you elevated read and write privileges to hidden or protected areas of the system. With the Mac root user account, you can even access files in other user accounts.

In fact, it gives you such God-like powers, you can modify or even delete critical system files. In fact, a Mac root user can use the rm -rf * command to delete the contents of every mounted drive in the computer, until macOS crashes when a crucial file or folder is deleted.

So this Mac root user account should only remain disabled unless you really, REALLY need to use it.

Suggested Reading : The Mac Root User Login & Password Guide

 

The macOS High Sierra Root Bug Updated!

On Tuesday, 28 November 2017, Turkish software developer Lemi Orhan Ergin revealed the macOS High Sierra root bug. With a few simple steps, anyone can gain elevated root user privileges in any computer running macOS High Sierra! Here is a summary of what we know about the root bug :

  1. The root bug exploit requires a computer running macOS High Sierra, with multiple user accounts.
  2. When prompted for a username and password, use these steps to gain root user access without any password :
    • Type “root” as the username and leave the password field blank.
    • Just click “Unlock” twice.
  3. The root bug cannot be exploited remotely, unless screen sharing is enabled.
  4. The root bug was introduced in macOS High Sierra 10.13.1. Earlier versions of macOS were not affected.
  5. Apple confirmed that the bug was due to “a logic error… in the validation of credentials“.
  6. Apple also confirmed that the bug would allow an attacker to “bypass administrator authentication without supplying the administrator’s password“.
  7. Several security researchers successfully replicated the bug.

 

How Serious Is This Root Bug?

The macOS High Sierra root bug is EXTREMELY serious, because it allows a hacker to easily bypass all of the macOS operating system’s security protections.

It doesn’t matter if you encrypted your computer, and secured it with an extremely long and complex password. Anyone who gains root user privileges using this bug can access (read, copy or move) the files in any user account (even those of an administrator) without knowing the password.

What’s even more troubling is that the root bug works even with a disabled root user account. This means the vast majority of Apple computers running on High Sierra are compromised, as the root user account is disabled by default.

 

How To Fix The Root Bug?

Unlike other security researchers, Lemi Orhan Ergin did not forewarn Apple before publicly revealing the bug, on Twitter no less. He basically exposed a zero-day vulnerability for hackers to use, while Apple rushes to fix the bug.

1. Install macOS Security Update 2017-001 New!

Apple just released Security Update 2017-001. This update will remove the root bug and improve credential validation. INSTALL THIS UPDATE NOW!

Note : This bug fix will reset and disable the root user account.  If you need to use the root user account, you will need to re-enable it, and change its password, after applying the update.

Note : Apple rushed out this update so quickly that they accidentally used a space instead of the version number. You can read more about this in our article – Apple Rushed Out macOS Root Bug Fix & It Shows…

This is not an issue if you are downloading the patch through the App Store. But if you’re applying the patch via Terminal, you need to add a space.

softwareupdate -i “Security Update 2017-001- “

2. Enable Root User With Your Own Password

[adrotate group=”2″]

If you cannot apply Apple’s bug fix yet, you can block this root bug by enabling the root user account, and setting a password for it.

It’s not so straightforward, so we created a step-by-step guide for you – The Mac Root User Login & Password Guide.

3. Use Additional Encryption

Alternatively, you can opt to move your sensitive data to encrypted containers or drives using third-party encryption utilities like VeraCrypt. Hackers may use the High Sierra root bug to gain access to the encrypted containers or drives, but without the correct password, the actual data won’t be accessible.

4. Physically Protect Your Apple Computer

The good news is the High Sierra root bug generally requires physical access to your Apple computer. Until this bug is fixed, you should make sure your Apple computer is never left unsupervised.

Keep it in a locked room or bag, whenever you are not using it. If no one can get to it, they cannot use the bug to gain root access.

5. Disable Screen Sharing

The High Sierra root bug can be exploited remotely if Screen Sharing is enabled. So make sure you disable Screen Sharing.

Go Back To > Articles | Home

 

Support Tech ARP!

If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!

The Mac Root User Login & Password Guide

1 Reply

Want to have elevated God-like privileges to your Mac OS X system? Then you need to be a Mac root user. In this guide, we will teach you how to enable the root user account in OS X, change the password, and disable it.

For experienced users or power users, you can use Terminal to quickly make these changes :

[adrotate group=”2″]

If you are an inexperienced user, you can use the GUI method, which has more steps but does not require keying in commands.

 

What Is The Mac Root User?

If you are the primary user of a MacOS X system, you have an administrator account with administrator privileges. This gives you more privileges and access than a standard user account. However, that is not the highest access level possible.

There is a Mac superuser account called “root” that gives you elevated read and write privileges to hidden or protected areas of the system. With the Mac root user account, you can even access files in other user accounts.

In fact, it gives you such God-like powers, you can modify or even delete critical system files. So this Mac root account should only remain disabled unless you really, REALLY need to use it.

OS X High Sierra currently has a root bug that allows practically root access in a few simple steps. Therefore, Apple advises you to enable the Mac root account, with your own password, until they fix the bug.

Suggested Reading : The macOS High Sierra Root Bug Explained

 

How To Enable The Mac Root User / Change Password (Terminal Method)

Requisite : You need to be logged into an administrator account.

Please note this method is used to both enable the root account, and to change its password. The single command line of sudo passwd root both changes its password, while enabling the root account.

Step 1 : Click on the Apple () menu, and select System Preferences.

Step 2 : Click on Utilities, and select Terminal.

Step 3 : Type sudo passwd root and press Enter.

sudo passwd root

Step 4 : You will be asked for your administrator password, not the new root password. Key in your administrator password and hit Enter.

Step 5 : Now key in the new root password, and hit Enter. Then retype the new root password for verification, and hit Enter.

That’s it! You have successfully enabled the Mac root account, with a password of your choice. To use it, you need to log off your administrator account.

[adrotate group=”1″]

 

How To Disable The Mac Root User (Terminal Method)

Requisite : You need to be logged into an administrator account.

Step 1 : In Terminal, type dsenableroot -d and press Enter.

dsenableroot -d

Step 2 : Key in your administrator password (not the root user password), and hit Enter.

If you succeed, you will see the notification : ***Successfully disabled root user.

Next Page > How To Enable The Mac Root User Account (GUI Method)

 

Support Tech ARP!

If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!

How To Enable The Mac Root User Account (GUI Method)

Requisite : You need to be logged into an administrator account.

Step 1 : Click on the Apple () menu, and select System Preferences.

Step 2 : Click on Users & Groups.

Step 3 : In the Users & Groups screen, click on the lock and key in your administrator name and password.

Step 4 : Click on Login Options.

[adrotate group=”1″]

Step 5 : Click on the Join… (or Edit…) button next to Network Account Server.

Step 6 : Click on the Open Director Utility… button.

Step 7 : Click on the lock, and key in your administrator name and password.

Step 8 : In the Directory Utility menu bar, select Edit and click on Enable Root User.

Step 9 : Now, key in the password you want, and a second time for verification, and click OK.

That’s it! You have successfully enabled the Mac root user account, with a password of your choice. To use it, you need to log off your administrator account.

Next Page > How To Change The Mac Root User Password

[adrotate group=”1″]

 

Support Tech ARP!

If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!

How To Change The Mac Root User Password (GUI Method)

Requisite : You need to be logged into an administrator account, and have the root user account enabled.

If you have just enabled the root user account, and are still in the Directory Utility screen, skip ahead to Step 8.

Step 1 : Click on the Apple () menu, and select System Preferences.

Step 2 : Click on Users & Groups.

Step 3 : In the Users & Groups screen, click on the lock and key in your administrator name and password.

Step 4 : Click on Login Options.

Step 5 : Click on the Join… (or Edit…) button next to Network Account Server.

[adrotate group=”1″]

Step 6 : Click on the Open Director Utility… button.

Step 7 : Click on the lock, and key in your administrator name and password.

Step 8 : In the Directory Utility menu bar, select Edit and click on Change Root Password.

Step 9 : Now, key in the new password you want, and a second time for verification, and click OK.

That’s it! You have successfully changed the Mac root user password. To use it, you need to log off your administrator account.

Next Page > How To Disable The Mac Root User Account

[adrotate group=”1″]

 

Support Tech ARP!

If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!

How To Disable The Mac Root User Account (GUI Method)

Requisite : You need to be logged into an administrator account, and have the root user account enabled.

If you have just enabled the root user account, and are still in the Directory Utility screen, skip ahead to Step 8.

Step 1 : Click on the Apple () menu, and select System Preferences.

Step 2 : Click on Users & Groups.

Step 3 : In the Users & Groups screen, click on the lock and key in your administrator user name and password.

Step 4 : Click on Login Options.

[adrotate group=”1″]

Step 5 : Click on the Join… (or Edit…) button next to Network Account Server.

Step 6 : Click on the Open Director Utility… button.

Step 7 : Click on the lock, and key in your administrator name and password.

Step 8 : In the Directory Utility menu bar, select Edit and click on Disable Root User.

That’s it! You have successfully disabled the Mac root user account.

Go Back To > First Page | Guides | Home

[adrotate group=”1″]

 

Support Tech ARP!

If you like our work, you can help support our work by visiting our sponsors, participating in the Tech ARP Forums, or even donating to our fund. Any help you can render is greatly appreciated!

Clock Share Bug In iOS Allows Access To Data

Leave a reply

While proving the SoFlo iPhone unlocking hoax, we stumbled upon a security bug in iOS 9.2.1. This security bug can be used to bypass the iOS device’s passcode or Touch ID. But it has to be done in a very specific way.

 

How To Exploit This Bug In iOS

Here is how you can exploit the bug in iOS 9.2.1 to gain access to every photo, video and contact stored in the iOS device, whether it is an iPhone, an iPad or an iPod touch.

  1. Log into the iOS device using the passcode / Touch ID.
  2. Open the Clock app and go to World Clock, and add a new Clock.
  3. Type a random word in the Search bar.
  4. Select the random word and tap to Share as a Message.

  1. Once the New Message screen opens, turn off the iOS device.
  2. Call Siri (without logging in using Touch ID / passcode) and ask for the time
  3. Click on the Clock after Siri tells you the time.
  4. Siri will not open up the World Clock, but will take you straight into New Message.
  5. Now add a random word to “To:” bar, and press Return.
  6. Double tap on the random word (now green in colour). It will bring you to the Info screen.
  7. Tap on Create New Contact.
  8. Tap on Add Photo. This will allow you to access the Photos app and EVERY photo and video in the iOS device.
  9. You can also tap on Add to Existing Contact to access the entire Contact List.
[adrotate banner=”5″]

 

Don’t Worry… Too Much

As you can tell by now, this security bug is very hard for a hacker to exploit. It requires prior access to the iOS device to “set up” the exploit.

The hacker will have to trick the owner into granting access to the iOS device. Then the hacker can follow the steps above up to no. 5. This will allow the hacker to exploit the bug (at a later time) to gain access to the iOS device’s photos, videos and contacts.

While this is a remote possibility, we nevertheless reported the security bug to Apple :

We then tested to see if the exploit would work on iOS 9.3 beta, and discovered something interesting.

It appears that Apple finally decided that it was superfluous to offer a Share option in the Clock app. How is that functionality useful to the user? It’s practically useless. So they removed the Share option completely.

In other words, even if you are logged into the iOS device, you can no longer go to the Clock app, key in a random word and Share it. The option is gone. As far as we can tell, it was gone as early as iOS 9.3 beta 5. We confirmed this in iOS 9.3 beta 6 as well (naturally).

So don’t worry too much. The coming iOS 9.3 update will fix this security bug in iOS 9.2.1 once and for all. In the meantime, just be careful who you lend your iOS device to!

 

Support Tech ARP!

If you like our work, you can help support our work by visiting our sponsors, participate in the Tech ARP Forums, or even donate to our fund. Any help you can render is greatly appreciated!