People going on about responsible disclosure when this is such a gross violation of CUSSE: https://web.archive.org/web/20170712120031/http://www.cusse....
macOS High Sierra: Anyone can login as “root” with empty password
261–270 of 1001 posts
Re: macOS High Sierra: Anyone can login as “root” with empty password
#262Am I missing something or does this require the attacker to have access to an unlocked computer? In which case all bets are off anyways.
>In which case all bets are off anyways
How are all bets off if they don't have access to a root user? This isn't Windows we're talking about.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#263Earlier quoted context omitted.
Mac OS X doesn't have a real root account, it uses sudo exclusively. This enables a true root user shell.
The root account always exists. Playing around with disable/enable and the exploit: Root always has a /bin/sh shell "Disable root user" removes the ShadowHashData from the directory services entry for root The bug sets ShadowHashData to the hash of an empty string. Now, ShadowHashData is a complex DS entry. I've never seen passwords represented this way in other OSX versions. I think this password storage format is n…
Your comment suggests that it is related to users with older, pre-High Sierra directory entries. That is, upgraded rather than freshly installed machines that leave older, pre-ShadowHashData intact. Is this correct?
Re: macOS High Sierra: Anyone can login as “root” with empty password
#264Can't reproduce on multiple High Sierra machines.
Can't repro on a 2012 retina MBP running 10.13.1, attempting the original repro and others suggested here. Until the wife walks away from hers, it's the only machine I have available. I'm curious as to the difference, given the high number of repros.
Apparently you have to have the password field focused before you submit. Anything in the password field (including nothing) will be saved as the root password.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#265Should I leave my Mac unattended until this is resolved?
Re: macOS High Sierra: Anyone can login as “root” with empty password
#266I wonder what is going on with software quality and testing at Apple. It feels like recently there have been quite a few issues like this (the FileVault password bug, numerous issues with iOS 11, the issue that totally broke iOS Safari a couple of years ago) which should have been fairly easily caught, especially given the limited range of devices their software runs on.
I know testing is hard, but a company with Apple’s resources shouldn’t be making slip ups like this. It suggests some real issues such as lack of unit/automated tests and/or sufficient release testing, which pretty urgently need addressing.
Anyone got any inside scoop?
Re: macOS High Sierra: Anyone can login as “root” with empty password
#267Encouraging users to "try it" is dangerous here. Recreating the bug enables root user across the system, and most users won't know how to disable it. TechCrunch, if you're reading this... please discourage people from reproducing the bug.
There’s no need to do this yourself to verify it. Doing so creates a “root” account that others may be able to take advantage of if you don’t disable it.
That should be much higher up in the article.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#268I don't know much about OS development but isn't this just the sort of thing you'd automate testing for?
I guess not. I recall reading somewhere that the Linux kernel doesn't even have automated tests. (edit: found the link: https://stackoverflow.com/a/3177643/96855)
Re: macOS High Sierra: Anyone can login as “root” with empty password
#269Apple has a serious software quality problem. Last night I was helping a friend with their computer. Safari couldn't even render apples website correctly. Nor could Safari connect to any site with HTTPS. Installed FireFox and HTTPS sites worked and apples's site renders. But the submit button on their developer site is broken[1]. Mail on my Mom's fully updated laptop crashes every time it's opened. Once I reported a…
Its not just Apple though. Microsoft had the similar problems in the past. Edge did not support silverlight causing people to move to other browser. It was strange to see Microsoft's own software not supported by Microsoft.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#270Earlier quoted context omitted.
It's the neighborly thing to do, but people are under no obligation to report vulns privately. The blame lies squarely on Apple, not on the messenger. The fact that we know about it means we can take steps to mitigate the damage.
The blame lies squarely on Apple, not on the messenger. There is blame on both. If you leave your key in your front door lock and I blast out on twitter your address and tell people about it, I think I have some responsibility.
A better analogy would be "if the lending bank left the door to your new house open..."
Other than buy an Apple product, the users did nothing intentional to undermine security.
Since this is a subjective argument, based more on historical instances of "responsible disclosure" and not law, I'm gonna lean in this case of it being Apple that failed
They built the entire "walled garden" without getting outside help. They want the control, they have billions of dollars, can hire whatever talent...
Failed to spot a password-less root login issue.
People need to know today to be even more cautious about using Apple gear in public places or around plain ol' tech jerks that like to fuck with people for a gag.
Society has no legal or moral obligation to make sure Apple stays in business.