undefined | Better HN

0 pointssimias13y ago0 comments

Are you sure? If it is it sounds like a possible security issue. Time is pretty sensitive as soon as certificates are involved. Many auth systems assume the clock is properly synchronized across the system.

If that's true IMO that's the security issue, not the arguably strange behaviour of sudo in a situation that should never occur.

0 comments

dazzawazza13y ago

well from the terminal

   $ date 010101011970
   date: bind: Permission denied
   date: settimeofday (timeval): Operation not permitted
   [15:45:41][dazza@imac.internal:~]

From System Preferences you can indeed set the date back to 1970:

   $ date
   Fri  2 Jan 1970 00:56:44 BST
   [00:56:44][dazza@imac.internal:~]

but there is a little lock that you might need to unlock (with a user password).

This does seem like a security issue on OSX.

adestefan13y ago

That little lock icon is the same as running sudo from the command line. If the user is listed as an Administrator, then they're also able to sudo.

pschastain13y ago

Changing back 01/01/1970 via Date & Time preferences doesn't need authentication, but the exploit still didn't work, at least for me.

acdha13y ago

> Changing back 01/01/1970 via Date & Time preferences doesn't need authentication

This is not true but it can be confusing if you've authenticated at all recently due to a grace period like sudo's.

1 more reply

j / k navigate · click thread line to collapse