Shostack + Friends Blog Archive

 

J8 RUSITH?

So it seems that Apple installs /bin/ps setuid root. (Scare #1).
It seems also that the last bits emitted by a ‘strings /bin/ps’ is 

J8 RUSITH?

. I have no idea what that is or what it means, but I think it belongs on a tshirt.

(Thanks to Dave and Ted for validating those for me. I thought I was 0wned.)

Originally published by adam on 11 Oct 2004
Last modified on 11 Oct 2004
Categories:   Uncategorized  

2 comments on "J8 RUSITH?"

  • Mort says:
    12 Oct 2004 at 6:34 pm

    http://www.opensource.apple.com/darwinsource/10.3.5/adv_cmds-63/ps.tproj/tasks.c

  • Mort says:
    14 Oct 2004 at 4:38 pm

    Further research indicates it’s been in the source code since at least 12/2000. I can’t find older code than that. If someone has access to the openstep source code, it would be interesting to see how far back it goes…
    -M

Comments are closed.