Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

151–160 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#151

Post by mcintyre1994 »

rwc wrote: post #101
jcoby wrote: post #38

Be careful testing this! It appears that you're creating a "root" superuser with no password. Be sure to clean up that user afterwords. https://twitter.com/a_hailes/status/935601901839806464

It's worse than that. You're enabling the root user EVERY time you use this vulnerability. Even if you disable the root user in Directory Utility, logging in with root and no password will re-enable the root user.

I haven't upgraded to High Sierra yet and this doesn't happen on my install atm. Does adding a password to the root user stop this vulnerability? If it does then that seems way better than disabling the account until this is fixed.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#152

Post by ZenoArrow »

e40 wrote: post #102
sillysaurus3 wrote: post #87

Earlier quoted context omitted.

It's the neighborly thing to do, but people are under no obligation to report vulns privately. The blame lies squarely on Apple, not on the messenger. The fact that we know about it means we can take steps to mitigate the damage.

The blame lies squarely on Apple, not on the messenger. There is blame on both. If you leave your key in your front door lock and I blast out on twitter your address and tell people about it, I think I have some responsibility.

You may say so, but really the level of incompetence of not setting a password for a root account is pretty high. The fact that someone reported it in a way you don't agree with shouldn't distract you from the fact that this highlights a serious oversight.

The main question that should be asked is, how did this get overlooked? How is it that your average website has better password security than the OS of one of the richest tech companies in the world?

To be fair to Apple, Microsoft had similar issues back in the 1990s. Perhaps it takes a string of security blunders for some tech companies to take security seriously.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#155

Post by pkaye »

zaro wrote: post #99

Wow. This is fun. I remember my Windows98 had the same feature. You just use Administrator with empty password and you're in. Apple is finally catching up.

Did Windows98 even have administrator role? I mean FAT file systems don't even have file ownership right?

Re: macOS High Sierra: Anyone can login as “root” with empty password

#156

Post by giobox »

mholt wrote: post #133
e40 wrote: post #102

Earlier quoted context omitted.

The blame lies squarely on Apple, not on the messenger. There is blame on both. If you leave your key in your front door lock and I blast out on twitter your address and tell people about it, I think I have some responsibility.

Wrong. This is Apple -- not the homeowners -- leaving everyone's key in everyone's door without them knowing.

Responsible Disclosure is widely regarded as a good practice in these situations. Blame isn't the key issue - fixing the problem quickly and safely is. Widespread disclosure before Apple have even a chance to respond in a timely fashion is inherently unsafe.

You would hope the self-described twitter bio "Agile Software Craftsman" might have thought about this a little before tweeting.

> https://en.wikipedia.org/wiki/Responsible_disclosure

Re: macOS High Sierra: Anyone can login as “root” with empty password

#157

Post by mikeash »

overcast wrote: post #33

Excuse my language, but this was a dick move to post this publicly, especially on Twitter. Go through private bug channels properly for something as serious as this. Of course doing it that way doesn't give you your 15 minutes of interweb fame.

Maybe he didn't know about the proper procedures to handle a security vulnerability. You wouldn't have to be a security researcher to discover this bug, and I don't see any indication that he is one.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#158

Post by Grollicus »

romanovcode wrote: post #115
zaro wrote: post #99

Wow. This is fun. I remember my Windows98 had the same feature. You just use Administrator with empty password and you're in. Apple is finally catching up.

Exactly my thoughts. I remember this, I think even early versions of WinXP had this feature.

Exactly early versions of Windows XP had this: They removed the Administrator user from their graphical login splash but when booted in rescue mode ("Safe mode") you could just type in "Administrator" with no password and were in. On Win98, you could just cancel the login.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#159

Post by LeoPanthera »

rwc wrote: post #101
jcoby wrote: post #38

Be careful testing this! It appears that you're creating a "root" superuser with no password. Be sure to clean up that user afterwords. https://twitter.com/a_hailes/status/935601901839806464

It's worse than that. You're enabling the root user EVERY time you use this vulnerability. Even if you disable the root user in Directory Utility, logging in with root and no password will re-enable the root user.

You can simply set a root password with "sudo passwd" to close the hole.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#160

Post by abestic9 »

michaelmcmillan wrote: post #72
ky738 wrote: post #51

Earlier quoted context omitted.

I will take malicious improper analogy for 100

Please point out the discrepancy. A Tesla has ~ 100.000.000 [1] lines of code. Considering this post, do you think we are sufficiently educated in software security to produce secure self-driving cars? Elon Musk: "I think one of the biggest risks for autonomous vehicles is somebody achieving a fleet wide hack" [2]. [1] https://bit.ly/KIB_linescode [2] https://www.youtube.com/watch?v=4G1Boh-URIM

These companies have completely different operating systems, network ACLs, software update policies and subsystems that affect certain mechanical features.

By your logic, we should not fly any modern commercial or military aircraft or spacecraft, live within a certain radius of any power or hazardous chemical plant, place any dependency on any first world country's health care network, including life support, or invest in any company or stock.

Like most things in life it comes down to a security/convenience risk/benefit compromise.

Post reply on HN