I'm sure many of us can often see how some kinds of bugs managed to slip through testing/QA, but this is crazy to me given it works on the login screen if it's happening for everyone on whatever version: is "user cannot log in as root when root account is disabled" not a test case? That seems.. insane?
macOS High Sierra: Anyone can login as “root” with empty password
231–240 of 1001 posts
Re: macOS High Sierra: Anyone can login as “root” with empty password
#232I don't know much about OS development but isn't this just the sort of thing you'd automate testing for?
If they are even a little smart, they'll now have a test for this ;)
Re: macOS High Sierra: Anyone can login as “root” with empty password
#233Am I missing something or does this require the attacker to have access to an unlocked computer? In which case all bets are off anyways.
What if it's a stolen laptop with an encrypted hard drive?
Re: macOS High Sierra: Anyone can login as “root” with empty password
#234[deleted]
Re: macOS High Sierra: Anyone can login as “root” with empty password
#235Are we really ready for self-driving cars? https://www.youtube.com/watch?v=4G1Boh-URIM
> Are we really ready for self-driving cars? Firstly, car automation is machine learning, not programming. Completely incomparable. Finally, we've known how to prove the absence of bugs for decades. It's not a matter of not knowing how, it's about incentives to do it right.
Is the authentication subsystem in a Tesla machine learning as well?
Re: macOS High Sierra: Anyone can login as “root” with empty password
#236I don't know much about OS development but isn't this just the sort of thing you'd automate testing for?
In order to create the test case that you would automate, you first must create the repro scenario. IOW, automation has nothing to do with this until the bug is found in the first place. Arguably, one could create a test model that might have found this but raise your hand if you even know what I'm talking about when I say "test model".
The only mitigation that automation would bring is if the bug was found in earlier versions, and test case was subsequently written. IOW, and very much a generalization, automation is to find regressions. But if the bug is new...
(To be clear, this bug still should have been found. But automation is unlikely to have found it.)
Re: macOS High Sierra: Anyone can login as “root” with empty password
#237I didn't think the BSD's allowed a blank root password.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#238Am I missing something or does this require the attacker to have access to an unlocked computer? In which case all bets are off anyways.
It requires the attacker to be able to type a few characters into a logged in session. If the session is not an administrative one, it's not fair to say all bets were off.
If I give you a Mac logged in with an unprivileged account and you can use only the keyboard and mouse to gain root access, the security has failed.
I think you've conflated this with the attacker having (full) physical access to the machine, which conventionally means access to its ports and perhaps a screwdriver. This is not that.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#239Encouraging users to "try it" is dangerous here. Recreating the bug enables root user across the system, and most users won't know how to disable it. TechCrunch, if you're reading this... please discourage people from reproducing the bug.
This bug exists regardless of user reproducing it or not. If there is anything good, reproducing it actually brings awareness to the user (make them change the password maybe). Hacker will "enable" the root user anyway. What should be done is that Apple releases fix to this problem.
Not the case.
Once you enable root access - by 'testing' this - others can remotely & silently access the system as root.
GP is right - don't encourage people to test this, as there's nothing to gain from it. If you're on a shared machine you need to mitigate. If you're on your own dedicated machine you need to not share it until this is fixed.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#240Earlier quoted context omitted.
This support article explains how to disable the root user: https://support.apple.com/en-us/HT204012
Do note that this doesn't fix the problem. The system (at least High Sierra) will happily re-enable the user for every attempt at logging in.
Just change the root password once the account is enabled; this fixes the hole.
sudo passwd -u root
It's sad we have to do this, though.