macOS High Sierra: Anyone can login as “root” with empty password • Hacker News Board

Re: macOS High Sierra: Anyone can login as “root” with empty password

#31

Post by fredsted » Tue, Nov 28, 2017, 8:16 PM UTC

This is very, very bad.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#32

Post by patcheudor » Tue, Nov 28, 2017, 8:16 PM UTC

Apple makes it pretty easy to report vulnerabilities to:

product-security@apple.com

They also respond to security@apple.com but prefer the product-security address.

Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed.

Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even if it is local: think of the impact to shared iMacs on university campuses.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#33

Post by overcast » Tue, Nov 28, 2017, 8:17 PM UTC

Excuse my language, but this was a dick move to post this publicly, especially on Twitter. Go through private bug channels properly for something as serious as this. Of course doing it that way doesn't give you your 15 minutes of interweb fame.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#34

Post by [deleted] » Tue, Nov 28, 2017, 8:17 PM UTC

[deleted]

Re: macOS High Sierra: Anyone can login as “root” with empty password

#35

Post by dsp1234 » Tue, Nov 28, 2017, 8:18 PM UTC

tombrossman wrote: post #15

Fellow Linux users, please keep the snark in this thread to a minimum. Here's just one recent example why, there are more: http://www.omgubuntu.co.uk/2017/05/ubuntu-guest-sessions-log...

Number of mentions of "Linux" outside of your thread comment chain: 0

Re: macOS High Sierra: Anyone can login as “root” with empty password

#36

Post by [deleted] » Tue, Nov 28, 2017, 8:19 PM UTC

michaelmcmillan wrote: post #21

Are we really ready for self-driving cars? https://www.youtube.com/watch?v=4G1Boh-URIM

[deleted]

Re: macOS High Sierra: Anyone can login as “root” with empty password

#37

Post by Unknoob » Tue, Nov 28, 2017, 8:19 PM UTC

Confirmed here on 10.13

Re: macOS High Sierra: Anyone can login as “root” with empty password

#38

Post by jcoby » Tue, Nov 28, 2017, 8:19 PM UTC

Be careful testing this! It appears that you're creating a "root" superuser with no password. Be sure to clean up that user afterwords.

https://twitter.com/a_hailes/status/935601901839806464

Re: macOS High Sierra: Anyone can login as “root” with empty password

#39

Post by Cshelton » Tue, Nov 28, 2017, 8:19 PM UTC

joe_hills wrote: post #7

I just tested this on a Sierra (10.12.6) machine, and verified this bug isn't present in that earlier OSX version.

Same, I'm on 10.12.6, could not reproduce anywhere.

I think I'll hold off on that 10.13.1 "security update" it keeps bugging me about. Seems to let anyone use my computer...

Edit: After looking a little further, it seems staying on Sierra will always be a 10.12.* version, and High Sierra is 10.13.*?

Re: macOS High Sierra: Anyone can login as “root” with empty password

#40

Post by jrowley » Tue, Nov 28, 2017, 8:20 PM UTC

jmuguy wrote: post #20

Time to install Afterdark on all the computers in the Apple store. Confirmed here, 10.13.1.

And I just googled afterdark at work... haha thanks!