[PeregrineX]

I'm surprised nobody's started a discussion on this.

Exploit-DB: Google it. Can't post links yet.

For all you Mac nerds: there is a new local root exploit, codenamed "rootpipe." It is for Yosemite, although the author states it should work for earlier versions. It exploits the system by abusing a hidden admin API framework call.

It already has a CVE: 2015-1130. Apple has tried to patch this in Yosemite recently, however, it flopped.

So, don't download ANY suspicious apps, especially new ones, until they really patch this. If you intend to use this exploit for your own nefarious purposes, go ahead.

Any thoughts? Will you be using this? Discuss below. 🎉🎉🎉

[w34k]

I believe it was patched with the latest update of OS X 10.10.3
https://support.apple.com/en-us/HT204659

PoC of the exploit here.
https://truesecdev.wordpress.com/2015/04...apple-os-x

I think it's funny how it's been around for that long. Makes you wonder what else is just waiting to be found.

[Statesman]

I'm surprised nobody's started a discussion on this.

Exploit-DB: Google it. Can't post links yet.

For all you Mac nerds: there is a new local root exploit, codenamed "rootpipe." It is for Yosemite, although the author states it should work for earlier versions. It exploits the system by abusing a hidden admin API framework call.

It already has a CVE: 2015-1130. Apple has tried to patch this in Yosemite recently, however, it flopped.

So, don't download ANY suspicious apps, especially new ones, until they really patch this. If you intend to use this exploit for your own nefarious purposes, go ahead.

Any thoughts? Will you be using this? Discuss below. 🎉🎉🎉

You don't know this was patched successfully last update ?? 🤗