Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

241–250 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#241

Post by mikeash »

overcast wrote: post #229
mikeash wrote: post #157

Earlier quoted context omitted.

Maybe he didn't know about the proper procedures to handle a security vulnerability. You wouldn't have to be a security researcher to discover this bug, and I don't see any indication that he is one.

I would say it's pretty basic common sense, not to publicly announce ANYTHING that could immediately affect millions of people. Unless he's just a sociopath. From his Twitter account, he's not just some layman stumbling across it. Agile Software Craftsman, iyzicoder @ http://www.iyzico.com , Founder of Software Craftsmanship Turkey @scturkey, The community guy http://bit.ly/lemiorhan

If that were true, then the security community wouldn't have spent years fighting about whether responsible disclosure was the right approach. That's for people who actually understand this stuff. It's unreasonable to expect an outsider to derive it all on their own from first principles.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#242

Post by AdamJacobMuller »

selectodude wrote: post #202
AdamJacobMuller wrote: post #193

Earlier quoted context omitted.

Enables root access in what way?

Mac OS X doesn't have a real root account, it uses sudo exclusively. This enables a true root user shell.

The root account always exists.

Playing around with disable/enable and the exploit: Root always has a /bin/sh shell "Disable root user" removes the ShadowHashData from the directory services entry for root The bug sets ShadowHashData to the hash of an empty string.

Now, ShadowHashData is a complex DS entry. I've never seen passwords represented this way in other OSX versions. I think this password storage format is new.

I strongly suspect the bug here is one related to OSX attempting to upgrade the password to the new storage format and when it does that, it inadvertently stores the password with a hash of null.

This should be very trivial for Apple to fix that (and thus "disable" the root user) by just removing any ShadowHashData that is solvable by an empty string.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#243

Post by stingraycharles »

devindotcom wrote: post #230
CrendKing wrote: post #223

Earlier quoted context omitted.

This bug exists regardless of user reproducing it or not. If there is anything good, reproducing it actually brings awareness to the user (make them change the password maybe). Hacker will "enable" the root user anyway. What should be done is that Apple releases fix to this problem.

Yeah that was my thought initially too but there may be invisible ways to leverage an existing root user that we're not aware of. After all, this bug exists...

The issue is that the bug leaves a password-less root account available through other means as well. Once you try to reproduce the bug, an attacker could potentially do a remote root login without password.

As such, it's very dangerous for people to try to verify and should be strongly discouraged.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#244

Post by Xeoncross »

mcintyre1994 wrote: post #231

I'm sure many of us can often see how some kinds of bugs managed to slip through testing/QA, but this is crazy to me given it works on the login screen if it's happening for everyone on whatever version: is "user cannot log in as root when root account is disabled" not a test case? That seems.. insane?

There are thousands of ways you could test this. Like most tests, having them isn't the same as having good ones.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#246

Post by michaelmcmillan »

mikeash wrote: post #216
michaelmcmillan wrote: post #72

Earlier quoted context omitted.

Please point out the discrepancy. A Tesla has ~ 100.000.000 [1] lines of code. Considering this post, do you think we are sufficiently educated in software security to produce secure self-driving cars? Elon Musk: "I think one of the biggest risks for autonomous vehicles is somebody achieving a fleet wide hack" [2]. [1] https://bit.ly/KIB_linescode [2] https://www.youtube.com/watch?v=4G1Boh-URIM

How much of that code is safety critical? I occasionally see misbehavior from my Tesla's center screen, like the network connection failing, or audio glitches, or even the occasional spontaneous reboot. This can be mildly annoying but it doesn't worry me because I know that the center screen is separate from the stuff where bugs can actually get me killed.

"On Thursday October 24, 2013, an Oklahoma court ruled against Toyota in a case of unintended acceleration that lead to the death of one the occupants. Central to the trial was the Engine Control Module's (ECM) firmware.

Embedded software used to be low-level code we'd bang together using C or assembler. These days, even a relatively straightforward, albeit critical, task like throttle control is likely to use a sophisticated RTOS and tens of thousands of lines of code. " [1] [2]

[1] https://www.edn.com/design/automotive/4423428/Toyota-s-kille...

[2] https://www.embedded.com/electronics-blogs/barr-code/4214602...

Re: macOS High Sierra: Anyone can login as “root” with empty password

#247

Post by arghwhat »

CrendKing wrote: post #223
thesephist wrote: post #183

Encouraging users to "try it" is dangerous here. Recreating the bug enables root user across the system, and most users won't know how to disable it. TechCrunch, if you're reading this... please discourage people from reproducing the bug.

This bug exists regardless of user reproducing it or not. If there is anything good, reproducing it actually brings awareness to the user (make them change the password maybe). Hacker will "enable" the root user anyway. What should be done is that Apple releases fix to this problem.

This vulnerability lets users activate the root user without using their password.

Once done, you have opened for root without password globally. That's bad.

What they should do, as responsible disclosure dictates, is report it in secret to apple, and at most publicize a workaround (activate root user, set password) without reporting the details of the vulnerability.

EDIT: It does not appear to be limited to admin users. It appears to be related to disabled root accounts of older origin, such as through upgrades. I cannot reproduce on a fresh High Sierra install, but I reproduced on an upgraded install.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#248

Post by ovao »

jtbayly wrote: post #127
glhaynes wrote: post #69

Earlier quoted context omitted.

As someone who tries to do risk analysis, the prospect of sticking with human drivers because of fear of software bugs (which inevitably will kill, just in much smaller numbers) terrifies me.

The fear is not of bugs killing people. The fear is of bugs allowing people to kill people. If ISIS was able to hack a major fleet through one such bug, do you think for a single moment they wouldn't make use of it to kill many people?

Which is a legitimate fear, and substantial effort should go into preventing such bugs, but any sufficiently determined person doesn't need to exploit a software bug to be able to kill others. ISIS appears to be quite effective at simply convincing its members to directly and voluntarily engage themselves in such acts.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#249

Post by zeveb »

tombrossman wrote: post #15

Fellow Linux users, please keep the snark in this thread to a minimum. Here's just one recent example why, there are more: http://www.omgubuntu.co.uk/2017/05/ubuntu-guest-sessions-log...

I'm a Linux desktop (and laptop!) user, and I agree (I haven't even used macOS in almost twenty years). Anyone remember the Debian OSPRNG issue?

These sorts of bugs can happen anywhere. We all need to bear that in mind.

One notable difference, though, is that macOS is proprietary software. Apple have sold their users a product and haven't respected their users' right to use, modify & distribute that product; their users have never had the ability to inspect the macOS source for this kind of problem. Thus, responsibility for this disaster rests solely on Apple's shoulders.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#250

Post by fredsted »

dyavuz wrote: post #56

In the meantime, if you'd like to protect your mac, you can set a password for root by going to: System Preferences > Users & Groups > Login Options > Join > Open Directory Utility > Edit > Change Root Password

Alternatively, there's `sudo passwd`.
Post reply on HN