[DemosCrash]

Every multi-user OS I know has had privilege elevation exploits. They are a common danger. Normally when running a server, all of the service accounts do not have logon privileges (meaning a hacker exploiting a service can't use it to log on), only the local admin accounts do. That restricts the abilities of someone who hacked a service. The hacker is left with trying to exploit the flaws in that service to perform a privilege elevation, which is harder than if they could just log on.

Nonetheless, it is very telling that somebody could exploit a local attack on OS X so easily. What that tells me is that OS X users are far too complacent about their own security. Most hacks with banks, financial companies, etc come from the inside. If average users can gain access to root-level resources so easily under OS X, there's clearly trouble brewing for Apple. And, given the recent proliferation of proof-of-concept attacks on OS X, I think you're going to see a *lot* more exploits being produced by (cr)(h)ackers. This isn't a one-off thing. It's going to get a lot worse for Apple before it gets better.

[antiRepublicrat]

Nonetheless, it is very telling that somebody could exploit a local attack on OS X so easily.

Well, it's easy if you've previously found an exploit, never notified the vendor, and use it when you get the chance.