On Aug 22, 2006, at 3:22 PM, K F wrote:
the admin users on OS X can NOT become root at any time.
Yes, they can.
The admin user must first know the admin password before becomming root.
Obviously. An admin user who doesn't know the admin password is not an admin user. He/she is a different user using an admin user's account.
Based on the info below ANYONE that sits down at your pc while it is logged in can take advantage of the fact that you can take root WITHOUT a password using the technique outlined below.
Not true. They must provide an admin password to use the Deja Vu pref pane, unless the admin user chose to leave it unlocked. (It's locked by default.)
Don't act like you have never let someone use a web browser or log into instant messenger on your computer before...
I don't have to act like it, because I don't unless I trust the person completely. I have a guest account for anyone else.
If you let people that you don't trust use your logged in admin account, you're asking for all kinds of trouble, whether or not you have Deja Vu installed. They could delete any/all folders within your Home folder, for example.
Kind Regards, -jeff -- Jeff Holland http://propagandaprod.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/