macOS High Sierra: Anyone can login as “root” with empty password • Hacker News Board

Re: macOS High Sierra: Anyone can login as “root” with empty password

#11

Post by Shank » Tue, Nov 28, 2017, 8:03 PM UTC

With user switching enabled as a username + password combo, I was able to login to the root account from the login screen with no password on 10.13.1. It's not just a UI bug, it's a full on authentication bypass.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#12

Post by donatj » Tue, Nov 28, 2017, 8:04 PM UTC

I can't seem to reproduce it locally. 10.13.1… Anyone else having issues?

I've upgraded a through a couple versions of OS X on this machine - maybe that makes a difference?

Re: macOS High Sierra: Anyone can login as “root” with empty password

#13

Post by notanai » Tue, Nov 28, 2017, 8:05 PM UTC

Can this be used remotely? Edit: Yes, after turning on Remote Management on my second mac I was able to log into it using Remote Desktop, account root and no pw. It only works after getting physical access once.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#14

Post by mratzloff » Tue, Nov 28, 2017, 8:06 PM UTC

Wow. As if I needed another reason to never "upgrade" to High Sierra...

Re: macOS High Sierra: Anyone can login as “root” with empty password

#15

Post by tombrossman » Tue, Nov 28, 2017, 8:06 PM UTC

Fellow Linux users, please keep the snark in this thread to a minimum. Here's just one recent example why, there are more: http://www.omgubuntu.co.uk/2017/05/ubuntu-guest-sessions-log...

Re: macOS High Sierra: Anyone can login as “root” with empty password

#16

Post by myth_buster » Tue, Nov 28, 2017, 8:07 PM UTC

Is social media the goto for reporting security vulnerabilities in 2017?

If I remember correctly, one is supposed to make it public once patched or in event of no response, no?

Edit: What is "Responsible Disclosure"[0]?

[0] https://en.wikipedia.org/wiki/Responsible_disclosure

Re: macOS High Sierra: Anyone can login as “root” with empty password

#17

Post by pmoriarty » Tue, Nov 28, 2017, 8:09 PM UTC

Has no one been running password crackers against OSX this whole time?

Re: macOS High Sierra: Anyone can login as “root” with empty password

#18

Post by hrrsn » Tue, Nov 28, 2017, 8:09 PM UTC

donatj wrote: post #12

I can't seem to reproduce it locally. 10.13.1… Anyone else having issues? I've upgraded a through a couple versions of OS X on this machine - maybe that makes a difference?

Worked fine for me on 10.13.1.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#19

Post by notanai » Tue, Nov 28, 2017, 8:09 PM UTC

You can just type root in the login window to get System administrator access.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#20

Post by jmuguy » Tue, Nov 28, 2017, 8:10 PM UTC

Time to install Afterdark on all the computers in the Apple store. Confirmed here, 10.13.1.