Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

341–350 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#341
post #300

I've been a developer for a long time. I understand bugs happen, even bugs with terrible consequences. A lot of bugs seem understandable, like I can see the chain of ifs/thens required to end up at some hilarious broken state. But I'm breaking my brain trying to figure out how in the hell a login attempt for "root" will enable it if it's disabled. Why is this is a possibility, to just enable root, no questions asked?

Another user suggested it may have to do with Apple’s new file system: https://news.ycombinator.com/item?id=15801643

Re: macOS High Sierra: Anyone can login as “root” with empty password

#342
post #324

Earlier quoted context omitted.

This vulnerability lets users activate the root user without using their password. Once done, you have opened for root without password globally. That's bad. What they should do, as responsible disclosure dictates , is report it in secret to apple, and at most publicize a workaround (activate root user, set password) without reporting the details of the vulnerability . EDIT: It does not appear to be limited to admin…

I run as a standard user and was able to reproduce the bug.

Updated. I was unable to reproduce on another machine as a standard user, but it appears to be related to it being a fresh install of High Sierra, not an upgraded install with old disabled root user entries.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#345
post #224

I wonder who they're going to ask to write a public letter of apology this time. This isn't just a snarky comment. They have just released the most awfull iOS upgrade for a long time, and now this. Something's messed up, and they better fix it soon. I've think i've read somewhere they merged the iOS and macOS teams, i suppose the wrong people were promoted during the operation.

Cue "incorrect elevation of privileges" joke.

  sudo laugh
edit: spelling

Re: macOS High Sierra: Anyone can login as “root” with empty password

#346

I wonder what is going on with software quality and testing at Apple. It feels like recently there have been quite a few issues like this (the FileVault password bug, numerous issues with iOS 11, the issue that totally broke iOS Safari a couple of years ago) which should have been fairly easily caught, especially given the limited range of devices their software runs on. I know testing is hard, but a company with App…

Anecdotal but I started noticing a decline in quality after Steve Jobs died.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#347

Encouraging users to "try it" is dangerous here. Recreating the bug enables root user across the system, and most users won't know how to disable it. TechCrunch, if you're reading this... please discourage people from reproducing the bug.

Yes, but the most secure thing to do at this point _is_ to recreate the bug and then set a password for the root user. Otherwise the hole is still there for others to exploit.

If you set a root password, this bug still works, it seems to reset the root password.

Edit: I was partly wrong. The bug still works if you disable root afterwards, then it reenables and resets it.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#348
post #196

I don't know much about OS development but isn't this just the sort of thing you'd automate testing for?

In order to create the test case that you would automate, you first must create the repro scenario. IOW, automation has nothing to do with this until the bug is found in the first place. Arguably, one could create a test model that might have found this but raise your hand if you even know what I'm talking about when I say "test model". The only mitigation that automation would bring is if the bug was found in earlie…

Respectfully disagree. "User cannot log in as root if root user is disabled" is absolutely a test case that should be written regardless of previously seeing the bug.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#349

I wonder what is going on with software quality and testing at Apple. It feels like recently there have been quite a few issues like this (the FileVault password bug, numerous issues with iOS 11, the issue that totally broke iOS Safari a couple of years ago) which should have been fairly easily caught, especially given the limited range of devices their software runs on. I know testing is hard, but a company with App…

Take this for the anecdata that it is. I interviewed at Apple, referred by old Microsoft friends that worked there. As I was trying to get a feel for things before the interview, I asked about the software testing. I was told, "don't expect what you're used to at Microsoft". The reference there is from when Microsoft often had more testers on a team than devs (ah, the good ol' days). The summary of what I was told by friends, and the questions I asked during the interview, is that testers at Apple aren't the testers that Microsoft used to have. Microsoft had testers working in MS Research, researching ways to better test software. Apple, from the impressions I got, is doing good to have testers than can write "hello, world". This was from the app side of things, not OS; I don't know if it's any different on the OS side.

But since I don't work there, I have no good inside info. But just from gut feel, I don't think my anecdata is too far off the mark. Based just on the bugs made public, I just don't get the impression that there are testers at Apple whose sole reason for being there is to tear into a piece of software and break it. There was a bug a few weeks ago posted to HN that I commented on. I don't have a link without digging through my comments, but it was something along the lines of "how could a tester not find this in five minutes of exploratory testing?" This bug is similar. It would take more than five minutes, but were this my area to test I'd pick at it once in a while when I had a few minutes. As I pick at it, I wouldn't expect to find anything, but I've got a minute between builds, so instead of randomly clicking Facebook I'll randomly click this dialog. What did the dev forget? What weird state was not accounted for? Some kind of state overflow if I click the button enough times? Shove some Unicode in there, that didn't find anything; meh, maybe I ought to move o...hey, wait a minute. Did that thing just log me in as root?

But my gut says that Apple doesn't employ a lot of testers like that.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#350
post #13

Can this be used remotely? Edit: Yes, after turning on Remote Management on my second mac I was able to log into it using Remote Desktop, account root and no pw. It only works after getting physical access once.

I tested this by logging in as root at a preference pane then attempting to connect via ssh and screen sharing (both enabled) using root with no password. It did not work.

Not sure if you'd get different results after logging in as root at the login screen...

Post reply on HN