Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

361–370 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#361

Post by lawnchair_larry »

giobox wrote: post #156
mholt wrote: post #133

Earlier quoted context omitted.

Wrong. This is Apple -- not the homeowners -- leaving everyone's key in everyone's door without them knowing.

Responsible Disclosure is widely regarded as a good practice in these situations. Blame isn't the key issue - fixing the problem quickly and safely is. Widespread disclosure before Apple have even a chance to respond in a timely fashion is inherently unsafe. You would hope the self-described twitter bio "Agile Software Craftsman" might have thought about this a little before tweeting. > https://en.wikipedia.org/wiki/…

"Responsible Disclosure" is a term rejected by the industry as a loaded phrase that favors vendors, instead preferring the term Coordinated Disclosure. Even so, reasonable professionals still disagree that this is the best option, in a debate that has existed for decades, so it's by no means settled as the "proper" way.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#362

Post by kreeWall »

thesephist wrote: post #183

Encouraging users to "try it" is dangerous here. Recreating the bug enables root user across the system, and most users won't know how to disable it. TechCrunch, if you're reading this... please discourage people from reproducing the bug.

Can you talk about how to correctly disable the root account if someone did try it?

Re: macOS High Sierra: Anyone can login as “root” with empty password

#363

Post by CGamesPlay »

kristofferR wrote: post #148
patcheudor wrote: post #32

Apple makes it pretty easy to report vulnerabilities to: product-security@apple.com They also respond to security@apple.com but prefer the product-security address. Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed. Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even…

I really disagree - this needs to be reported as much as possible publicly to create a huge thunderstorm of negative publicity for Apple. This isn't the first extremely serious and dumb High Sierra password bug this year [1] [2], and unless Apple is severely hurt by it, so they're forced to change, it won't be the last. High Sierra is full of bugs and seemingly not just annoying bugs, but also security bugs. Let's ho…

Don't forget the Disk Utility password disclosure! https://www.macrumors.com/2017/10/05/macos-high-sierra-disk-...

Re: macOS High Sierra: Anyone can login as “root” with empty password

#364

Post by intelliot »

davidkuhta wrote: post #345
bsaul wrote: post #224

I wonder who they're going to ask to write a public letter of apology this time. This isn't just a snarky comment. They have just released the most awfull iOS upgrade for a long time, and now this. Something's messed up, and they better fix it soon. I've think i've read somewhere they merged the iOS and macOS teams, i suppose the wrong people were promoted during the operation.

Cue "incorrect elevation of privileges" joke. sudo laugh edit: spelling

Cue

Re: macOS High Sierra: Anyone can login as “root” with empty password

#365

Post by thomastjeffery »

Jedd wrote: post #239
CrendKing wrote: post #223

Earlier quoted context omitted.

This bug exists regardless of user reproducing it or not. If there is anything good, reproducing it actually brings awareness to the user (make them change the password maybe). Hacker will "enable" the root user anyway. What should be done is that Apple releases fix to this problem.

Not the case. Once you enable root access - by 'testing' this - others can remotely & silently access the system as root. GP is right - don't encourage people to test this, as there's nothing to gain from it. If you're on a shared machine you need to mitigate. If you're on your own dedicated machine you need to not share it until this is fixed.

> others can remotely & silently access the system as root.

They already can:

https://gfycat.com/gifs/detail/sentimentalnaiveantelopegroun...

Re: macOS High Sierra: Anyone can login as “root” with empty password

#366

Post by tn_ »

pcwalton wrote: post #135
e40 wrote: post #102

Earlier quoted context omitted.

The blame lies squarely on Apple, not on the messenger. There is blame on both. If you leave your key in your front door lock and I blast out on twitter your address and tell people about it, I think I have some responsibility.

The problem with that analogy is that the probability that the "bad guys" already know about this vulnerability is vastly higher than the probability that thieves know about how well some random house in the neighborhood is secured.

How many more people now know about this vulnerability cause of this knuckle-head tweeting it? At least 100k impressions? Now think of how many more "bad guys" have access to this hack that are going to abuse it.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#368

Post by arghwhat »

sounds wrote: post #272
arghwhat wrote: post #247

Earlier quoted context omitted.

This vulnerability lets users activate the root user without using their password. Once done, you have opened for root without password globally. That's bad. What they should do, as responsible disclosure dictates , is report it in secret to apple, and at most publicize a workaround (activate root user, set password) without reporting the details of the vulnerability . EDIT: It does not appear to be limited to admin…

I agree that we need more responsible disclosure. But as https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-w... explains, blame the DMCA. Somebody in Turkey has no expectation that they will be treated with respect. It's much more likely they will be attacked as in "shoot the messenger." (So, please don't attack the person who brought this to our attention.) I think they made a reasonable decision, due to th…

But throwing it on twitter doesn't stop you from using the DMCA, and having the DMCA used against you doesn't stop you from posting it on Twitter as counter-measure (which might make the company retract the use of DMCA to avoid publicity about suing "messengers"). If you're afraid of DMCA, keep your mouth shut and stay away from the US.

The DMCA is a disgusting and absurd set of laws that can always make me angry. Its existence alone proves very much how big companies can rule with money, placing capitalism over democracy.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#369

Post by thanatropism »

2trill2spill wrote: post #337
tomduncalf wrote: post #266

I wonder what is going on with software quality and testing at Apple. It feels like recently there have been quite a few issues like this (the FileVault password bug, numerous issues with iOS 11, the issue that totally broke iOS Safari a couple of years ago) which should have been fairly easily caught, especially given the limited range of devices their software runs on. I know testing is hard, but a company with App…

It seems apple's software has been trending down in quality since Snow Leopard.

I'll agree that Snow Leopard is the high water-mark.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#370

Post by dec0dedab0de »

raydev wrote: post #300

I've been a developer for a long time. I understand bugs happen, even bugs with terrible consequences. A lot of bugs seem understandable, like I can see the chain of ifs/thens required to end up at some hilarious broken state. But I'm breaking my brain trying to figure out how in the hell a login attempt for "root" will enable it if it's disabled. Why is this is a possibility, to just enable root, no questions asked?

I'm having a hard time understanding how this could happen too.

It would have to be that looking up the root account enabled it, maybe users go dormant or something, and this was a way to readd them? then once it was enabled it defaulted to a blank password, but you would think that it needs sudo to enable root in the first place.

Post reply on HN