I've been a developer for a long time. I understand bugs happen, even bugs with terrible consequences. A lot of bugs seem understandable, like I can see the chain of ifs/thens required to end up at some hilarious broken state. But I'm breaking my brain trying to figure out how in the hell a login attempt for "root" will enable it if it's disabled. Why is this is a possibility, to just enable root, no questions asked?
macOS High Sierra: Anyone can login as “root” with empty password
341–350 of 1001 posts
Re: macOS High Sierra: Anyone can login as “root” with empty password
#342Earlier quoted context omitted.
This vulnerability lets users activate the root user without using their password. Once done, you have opened for root without password globally. That's bad. What they should do, as responsible disclosure dictates , is report it in secret to apple, and at most publicize a workaround (activate root user, set password) without reporting the details of the vulnerability . EDIT: It does not appear to be limited to admin…
I run as a standard user and was able to reproduce the bug.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#343Now that this is public, it's likely worth passing this message on to non-technical folks too (e.g. share this or write a similar post - this is my only public post): https://www.facebook.com/amar.sood/posts/10209545863036116
Re: macOS High Sierra: Anyone can login as “root” with empty password
#344Until Apple forces me to with a required xCode update for the newest iOS SDK...>.>
Re: macOS High Sierra: Anyone can login as “root” with empty password
#345I wonder who they're going to ask to write a public letter of apology this time. This isn't just a snarky comment. They have just released the most awfull iOS upgrade for a long time, and now this. Something's messed up, and they better fix it soon. I've think i've read somewhere they merged the iOS and macOS teams, i suppose the wrong people were promoted during the operation.
sudo laugh
edit: spellingRe: macOS High Sierra: Anyone can login as “root” with empty password
#346I wonder what is going on with software quality and testing at Apple. It feels like recently there have been quite a few issues like this (the FileVault password bug, numerous issues with iOS 11, the issue that totally broke iOS Safari a couple of years ago) which should have been fairly easily caught, especially given the limited range of devices their software runs on. I know testing is hard, but a company with App…
Re: macOS High Sierra: Anyone can login as “root” with empty password
#347Encouraging users to "try it" is dangerous here. Recreating the bug enables root user across the system, and most users won't know how to disable it. TechCrunch, if you're reading this... please discourage people from reproducing the bug.
Yes, but the most secure thing to do at this point _is_ to recreate the bug and then set a password for the root user. Otherwise the hole is still there for others to exploit.
Edit: I was partly wrong. The bug still works if you disable root afterwards, then it reenables and resets it.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#348I don't know much about OS development but isn't this just the sort of thing you'd automate testing for?
In order to create the test case that you would automate, you first must create the repro scenario. IOW, automation has nothing to do with this until the bug is found in the first place. Arguably, one could create a test model that might have found this but raise your hand if you even know what I'm talking about when I say "test model". The only mitigation that automation would bring is if the bug was found in earlie…
Re: macOS High Sierra: Anyone can login as “root” with empty password
#349I wonder what is going on with software quality and testing at Apple. It feels like recently there have been quite a few issues like this (the FileVault password bug, numerous issues with iOS 11, the issue that totally broke iOS Safari a couple of years ago) which should have been fairly easily caught, especially given the limited range of devices their software runs on. I know testing is hard, but a company with App…
But since I don't work there, I have no good inside info. But just from gut feel, I don't think my anecdata is too far off the mark. Based just on the bugs made public, I just don't get the impression that there are testers at Apple whose sole reason for being there is to tear into a piece of software and break it. There was a bug a few weeks ago posted to HN that I commented on. I don't have a link without digging through my comments, but it was something along the lines of "how could a tester not find this in five minutes of exploratory testing?" This bug is similar. It would take more than five minutes, but were this my area to test I'd pick at it once in a while when I had a few minutes. As I pick at it, I wouldn't expect to find anything, but I've got a minute between builds, so instead of randomly clicking Facebook I'll randomly click this dialog. What did the dev forget? What weird state was not accounted for? Some kind of state overflow if I click the button enough times? Shove some Unicode in there, that didn't find anything; meh, maybe I ought to move o...hey, wait a minute. Did that thing just log me in as root?
But my gut says that Apple doesn't employ a lot of testers like that.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#350Can this be used remotely? Edit: Yes, after turning on Remote Management on my second mac I was able to log into it using Remote Desktop, account root and no pw. It only works after getting physical access once.
Not sure if you'd get different results after logging in as root at the login screen...