Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

171–180 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#171

Post by dsp1234 »

patcheudor wrote: post #32

Apple makes it pretty easy to report vulnerabilities to: product-security@apple.com They also respond to security@apple.com but prefer the product-security address. Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed. Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even…

think of the impact to shared iMacs on university campuses.

I'm sure Apple will in the future.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#172

Post by DavideNL »

rwc wrote: post #101
jcoby wrote: post #38

Be careful testing this! It appears that you're creating a "root" superuser with no password. Be sure to clean up that user afterwords. https://twitter.com/a_hailes/status/935601901839806464

It's worse than that. You're enabling the root user EVERY time you use this vulnerability. Even if you disable the root user in Directory Utility, logging in with root and no password will re-enable the root user.

...unless you set a password, right?

Re: macOS High Sierra: Anyone can login as “root” with empty password

#173

Post by manwe150 »

I'm on Sierra and haven't been able to reproduce. But does anyone know if it respects pam.d "nullok" and I could just delete that option?

    /etc/pam.d$ grep -RI nullok /etc/pam.d
    /etc/pam.d/authorization:auth       required       pam_opendirectory.so use_first_pass nullok
    /etc/pam.d/checkpw:auth       required       pam_opendirectory.so use_first_pass nullok
    /etc/pam.d/screensaver:auth       required       pam_opendirectory.so use_first_pass nullok

Re: macOS High Sierra: Anyone can login as “root” with empty password

#174

Post by fixermark »

overcast wrote: post #33

Excuse my language, but this was a dick move to post this publicly, especially on Twitter. Go through private bug channels properly for something as serious as this. Of course doing it that way doesn't give you your 15 minutes of interweb fame.

When I put it into my personal malice / ignorance balance, it weighs out to the likelihood that the discloser isn't plugged in enough to the infosec scene to be aware that there are already best practices for this kind of disclosure.

It's a big world out there, especially nowadays. And nothing I've seen in recent history suggests to me the average user knows or cares about infosec concerns beyond basic hindsight understandings.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#175

Post by zerostar07 »

patcheudor wrote: post #32

Apple makes it pretty easy to report vulnerabilities to: product-security@apple.com They also respond to security@apple.com but prefer the product-security address. Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed. Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even…

People are already fixing their machines because he tweeted. this is too much of a huge blunder to wait for the official channels.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#178

Post by arghwhat »

It seems to activate the root user with an empty password if you try, as an admin user, to use "root"/"" as credentials in a System Preferences authentication prompt.

It does not work if you are not admin. It does not work if your root user is enabled and has a password set. If you tried the vuln, you should set a password for the root user ("sudo passwd root").

Re: macOS High Sierra: Anyone can login as “root” with empty password

#179

Post by fixermark »

overcast wrote: post #108
zerostar07 wrote: post #86

Earlier quoted context omitted.

this is too serious to hide. better to tell users how to fix it than wait until apple releases something

Yeh, except for the millions of MacOS users out there, like my parents who don't read Twitter, or HN or any of the other sites people think that everyone stays up on. They are the targets.

Not technically. Exploitation still requires physical access to the machine or remote access to have been enabled, right? Did your parents who don't read Twitter or HN enable a feature that generally only power users want or need?

Re: macOS High Sierra: Anyone can login as “root” with empty password

#180

Post by zeveb »

patcheudor wrote: post #32

Apple makes it pretty easy to report vulnerabilities to: product-security@apple.com They also respond to security@apple.com but prefer the product-security address. Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed. Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even…

> Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even if it is local: think of the impact to shared iMacs on university campuses.

It gets the word out quickly.

Releasing proprietary software with such a hilariously insecure authentication system isn't cool. This isn't free software, produced by people & corporations out of the goodness of their hearts; rather, it's something for which people pay a good deal of money and which they have a right to expect is at least somewhat secure.

Getting the word out, fast that a) there's a huge insecurity and b) it's in Apple software provides benefits to those running macOS (so they can fix their systems) and to those considering running macOS (so they can evaluate whether an alternative is more appropriate).

Post reply on HN