When Apple launched a whole array of new features with Mac OS 9 in 1999, they called it ‘the best internet operating system ever.’
At the time, the 12-year-old Joshua Hill only had an old Mac Performa, so he was in dire need of a modem that he could plug into this device via one of its ‘serial’ ports. He swapped his trading card with a buddy for a 56k modem and began experimenting. And 20 years later, what he found helped him to discover a modem configuration flaw that had been hidden in Apple’s Mac OS for all these years….and was only fixed in April 2019.
Joshua, who today is a vulnerability researcher, presented evidence of the two-decades-old bug at the Sea Mac security conference this weekend. The bug could potentially have granted an attacker persistent remote root access to any Mac computer. The upside, Hill says, is that it only works on specific generations of Mac OS and OS X and that Apple started introducing protections about three years ago with macOS Sierra.
He doesn’t actually think it’s such a huge deal. He was just playing around and discovered that he could use a feature called Remote Access to call into his buddy’s Mac remotely and, as he describes it, ‘have some fun.”
Although Remote Access is no longer part of macOS, in 2017, while he was doing research for Guardian, he stumbled on a very old bug that could be used to replicate a similar effect. He found that the same old modem configurations still underpinned modern Macsand that it could be used by a hacker in much the same way.
He says: “It’s very bad programming practice, but this is very, very old code.”
Apple failed to comment on his discovery.