To revisit the：ARDAgent.app security vulnerability

As early as in 2008，Apple's operating system is broke so a security incident。

That is the system program ARDAgent.app。This application is a system level，It has the highest level of authority - the root / administrator privileges。

That is，It do anything on the computer，They are permitted does not require，You do not need to know。This program is part of the Mac remote login，It is no window，It will not appear in your dock bar。Will only start when needed，Get root access，do anything。

This program was originally used laboratory debugging purposes，Or will only be enabled when a network administrator large quantities of remote operation，But there are always two sides to everything，I will not burst one might mention the right to use this program remote，Then it can execute arbitrary code on your computer - Well，Apple did not make any response to this vulnerability。

Until now，As if the problem - the potential vulnerabilities and no one has been concerned about how，In particular heavenly fart ......

In short，Why mention this thing again today routing it，Because in seven years，I once again encountered this problem。

Tip program SUID file has been modified and will not be repaired

This error is encountered using the system comes with the disk management tool to check permissions when。

Search，I found this page，It is Apple's official TS Page "Mac OS X：You can safely ignore the Disk Utility's Repair Disk Permissions Information"Nature，This error message is included，That is，this is normal、safe。

• Warn：SUID file "System / Library / CoreServices / RemoteManagement / ARDAgent.app / Contents / MacOS / ARDAgent" has been modified，Will not be repaired。

But either way，This thing has not been previously modified out，But now it is being modified，Considering that most people should not use this "is the remote control" feature，So I think it's good to do something。

Follow the prompts，We are at

Found in this directoryARDAgent.appThis application，Then，To avoid this potential security threat，The best way is toDeletedFriends ~

Oh，Remember deleting，It put a zip file compression，

Right-click on，Options in the pop-up menu, select "Compression"

Then good compressionARDAgent.appBecause the file permission issues，You will be placed on your desktop，then，You can rest assured that bold delete thisARDAgent.app，And then towed back to the original desktop compressed backup directory just fine。(These two steps will require you to enter the current user's password to gain permission。）

Such，Check the disk permissions again，That error has disappeared，Next time, if necessary，Just go to the corresponding directory can unlock the archive。

Original article written by LogStudio：R0uter's Blog » To revisit the：ARDAgent.app security vulnerability

Reproduced Please keep the source and description link：https://www.logcg.com/archives/843.html