Posts Tagged ‘macosx’

First Trojan Based on ARDAgent Root Exploit

Monday, June 23rd, 2008

Secure Mac are reporting that they have found a trojan designed to take advantage of the ARDAgent root exploit that I posted about previously.

The Trojan dubbed “AppleScript.THT” allows the remote attacker full access to the system, steals usernames and passwords, hides by turning off system logging, opening firewall ports and can also be used to install key logging software, take pictures using the inbuilt iSight and to enable file sharing.

The Trojan come as either a compiled AppleScript titled ASthtv05 or as a disc image called ASthtv_06. In both cases, the files have to be downloaded and executed by the user. At the moment, the Trojan does not take advantage of any other Mac vulnerabilities to automatically infect new machines – but that’s probably only a matter of time.

Secure Mac are advising Mac users to use MacScan to protect themselves against the threat. Or you could just stop the ARDAgent service from running scripts as root.

Temporary Fix for ARDAgent Root Privilege Escalation

Friday, June 20th, 2008

If you’re worried about the security problem with Apples Remote Desktop Sharing that I posted about yesterday, but still want to use the service, then here’s a quick solution:

Open Terminal and type, all on one line, the following command:


sudo chmod u-s /System/Library/CoreServices/RemoteManagement/
ArdAgent.app/Contents/MacOS/ARDAgent

Now if you use,

osascript -e 'tell app "ARDAgent" to do shell script "whoami"'

you should get your own username back.

Mac OS X – Gain Root Privileges Through AppleScript

Thursday, June 19th, 2008

A serious security hole has been found in Mac OS X – both Leopard and Tiger are affected. The exploit allows someone with physical access to a Mac to run programs as the Root user.

The exploit uses the Apple Remote Desktop, (ARDAgent), application to execute a shell script. When the shell script is executed it is done so as Root. To test this, type the following command in Terminal:


osascript -e 'tell app "ARDAgent" to do shell script "whoami"'

This command works even if Remote Desktop Sharing is disabled and the Root user is disabled in the Directory Utility. However, it will only work if the user is logged into the computer. It will not work if Fast User Switching has been used.

As this is a brand new exploit there is no fix as of yet.

Reinstate the 2D Dock in Mac OS 10.5 Leopard

Tuesday, November 6th, 2007

After giving out about the new 3D Dock introduced in Leopard, I came across this hint to reinstate the 2D dock. Open a terminal window and type:


defaults write com.apple.dock no-glass -boolean YES; killall Dock

The Dock will restart with the 2D look, albeit with the blue luminous application indicators still in place.

My Initial Reaction to Mac Os 10.5 Leopard – Part 2

Monday, November 5th, 2007

Apart from the new look to Leopard, Apple have also introduced some new features with the latest instalment of their OS. The big ones are Stacks, Spaces and Time Machine.

Stacks are a new way to browse folders that are saved in the Dock. Instead of opening in a Finder window, the folder contents are displayed as either a fan, (for folders with less than 8 items), or as a grid, (for items with more than 8 items).

Stacks using Fan Layout

Stacks using Grid Layout

If you come from a *nix background you’ll be familiar with the concept of workspaces and virtual desktops. Apple have incorporated this idea into Leopard. You can now group your applications into their own virtual desktops. Spaces also allows you to specify which desktop an application should always open in. So if for example you want your email client to open on another desktop, then you can do so in the Spaces preferences.

Spaces Settings

By default Spaces is turned off, so if you want to use it, you’ll have to enable it in System Preferences -> Expose and Spaces. The initial configuration allows for 4 Spaces, but this can be increased up to a maximum of 16.

And then there’s Time Machine. Everyone is talking about Apples new backup program. It’s proving to be the killer application for Leopard and it’s easy to see why. Time Machine has turned a chore into something that’s almost fun. Time Machine does nothing more than make incremental backups of your Mac – hourly, daily and weekly snapshots are taken – and it does it very well.

In order to use Time Machine a large external hard drive is required. The disk also needs to be formatted with the Mac OS Extended File System. Once you attach the drive to your Mac, you’ll be prompted to use it as your backup disk:

Time Machine Prompt

From there it’s just a matter of letting Time Machine do it’s thing. If you need to restore a backup, then starting the Time Machine application opens a new window that allows you to browse all the previous backups. It really is something to behold. Unfortunately I can’t show you a screenshot, but you can get an idea of what it looks like here.

Apple Boot Camp Updated

Thursday, March 29th, 2007

Apple have updated Boot Camp to work with the 32bit version of Windows Vista. They’ve also included updated drivers, the ability to use the Apple remote with Windows and a tray icon to access Boot Camp functionality from Windows. For you Mac users, Boot Camp is available here.