macOS High Sierra: Anyone can login as “root” with empty password • Hacker News Board

Re: macOS High Sierra: Anyone can login as “root” with empty password

#391

Post by thomastjeffery » Tue, Nov 28, 2017, 9:43 PM UTC

jonny_eh wrote: post #185

Looks like changing root’s password blocks the exploit but if you disable the root user, it re-enables the exploit. Protect yourself by changing root’s password: ⌘ (Command) + Space, Directory Utility, click the lock and enter your password, Edit -> Change Root Password…, then do NOT disable Root User. Or open a terminal and do: sudo passwd

    sudo passwd

Does that change the password for the current user without authentication, or does it change the password for root without authentication?

I think it would be best to recommend an unambiguous

    sudo passwd root

Re: macOS High Sierra: Anyone can login as “root” with empty password

#392

Post by Asmod4n » Tue, Nov 28, 2017, 9:43 PM UTC

arghwhat wrote: post #263

AdamJacobMuller wrote: post #242

Earlier quoted context omitted.

The root account always exists. Playing around with disable/enable and the exploit: Root always has a /bin/sh shell "Disable root user" removes the ShadowHashData from the directory services entry for root The bug sets ShadowHashData to the hash of an empty string. Now, ShadowHashData is a complex DS entry. I've never seen passwords represented this way in other OSX versions. I think this password storage format is n…

Your comment suggests that it is related to users with older, pre-High Sierra directory entries. That is, upgraded rather than freshly installed machines that leave older, pre-ShadowHashData intact. Is this correct?

Works with El Capitan too.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#393

Post by kowdermeister » Tue, Nov 28, 2017, 9:43 PM UTC

andrewstuart2 wrote: post #170

valine wrote: post #27

This is deeply troubling. How does this even happen?

All too easily. There's so much to keep track of in modern systems engineering. We should all have a healthy dose of awareness that we could be/create that weakest link even on our best days.

Errr... umm... unit tests? Tests?

Re: macOS High Sierra: Anyone can login as “root” with empty password

#394

Post by mikestew » Tue, Nov 28, 2017, 9:43 PM UTC

couchand wrote: post #348

mikestew wrote: post #236

Earlier quoted context omitted.

In order to create the test case that you would automate, you first must create the repro scenario. IOW, automation has nothing to do with this until the bug is found in the first place. Arguably, one could create a test model that might have found this but raise your hand if you even know what I'm talking about when I say "test model". The only mitigation that automation would bring is if the bug was found in earlie…

Respectfully disagree. "User cannot log in as root if root user is disabled" is absolutely a test case that should be written regardless of previously seeing the bug.

Meh, you're probably right. If nothing else, I'd want to verify the result of trying to use a disabled account (text in the dialog is localized, et. al.) Run through the scenario before I formally write the case and...WTF? Yeah, I could see that.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#395

Post by jackhack » Tue, Nov 28, 2017, 9:43 PM UTC

kristofferR wrote: post #148

patcheudor wrote: post #32

Apple makes it pretty easy to report vulnerabilities to: product-security@apple.com They also respond to security@apple.com but prefer the product-security address. Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed. Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even…

I really disagree - this needs to be reported as much as possible publicly to create a huge thunderstorm of negative publicity for Apple. This isn't the first extremely serious and dumb High Sierra password bug this year [1] [2], and unless Apple is severely hurt by it, so they're forced to change, it won't be the last. High Sierra is full of bugs and seemingly not just annoying bugs, but also security bugs. Let's ho…

I'm more concerned that the "exploit" works "after a few tries" and not the first-time-every-time, or not at all.

One would think that something as simple as a login would be deterministic.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#396

Post by openasocket » Tue, Nov 28, 2017, 9:44 PM UTC

testvox wrote: post #255

patcheudor wrote: post #124

Earlier quoted context omitted.

I get it, I really do, but it's not like he was complaining about a bad Uber driver. Disclosure in this way has real-world impacts up to and including harming people and we shouldn't ever consider it as something which is remotely acceptable. Is it acceptable to publicly disclose that an airport has a self-destruct switch which can be accessed near the NW mens bathroom? No. You contact someone who can fix the problem…

But everyone can fix this problem by setting a root password. So telling everyone is the right call. Otherwise people would be sitting vulnerable while Apple comes up with a patch.

But a tweet isn't really the most effective way to tell everyone. Technical people, including those who would use this vulnerability for malice, will find out far far sooner than my grandmother.

It seems to me the right thing to do is to tell Apple privately, tell them to either push a fix or put out some kind of release letting all their customers know how to mitigate this in the next, say, 3 days, or I'll just tweet about it. What's the downside? At the worst case, you just prolonged the status quo for another 3 days.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#397

Post by ianmcgowan » Tue, Nov 28, 2017, 9:44 PM UTC

mholt wrote: post #322

tomduncalf wrote: post #266

I wonder what is going on with software quality and testing at Apple. It feels like recently there have been quite a few issues like this (the FileVault password bug, numerous issues with iOS 11, the issue that totally broke iOS Safari a couple of years ago) which should have been fairly easily caught, especially given the limited range of devices their software runs on. I know testing is hard, but a company with App…

> Anyone got any inside scoop? I have a feeling that anyone who does would get fired for commenting here about it.

You have to think that whoever was responsible for testing this is going to get fired. This is egregiously bad...

Re: macOS High Sierra: Anyone can login as “root” with empty password

#398

Post by EpicEng » Tue, Nov 28, 2017, 9:45 PM UTC

mholt wrote: post #308

EpicEng wrote: post #262

Earlier quoted context omitted.

>In which case all bets are off anyways How are all bets off if they don't have access to a root user? This isn't Windows we're talking about.

If you lose physical control over the machine, all bets are off because an attacker can modify the hardware to do nefarious things.

ok, sure, but in practice that is pretty unlikely.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#399

Post by tekacs » Tue, Nov 28, 2017, 9:45 PM UTC

LeoPanthera wrote: post #159

rwc wrote: post #101

Earlier quoted context omitted.

It's worse than that. You're enabling the root user EVERY time you use this vulnerability. Even if you disable the root user in Directory Utility, logging in with root and no password will re-enable the root user.

You can simply set a root password with "sudo passwd" to close the hole.

And you might want to disable the root account again with `dsenableroot -d` as well, so that the root account stays disabled after the vulnerability is patched.

Unlike doing this through the GUI, this seems to retain the root password and prevent this vuln from re-occuring.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#400

Post by thomastjeffery » Tue, Nov 28, 2017, 9:45 PM UTC

mrmondo wrote: post #378

1. Ensure you always have FileVault enabled (you should regardless) and shutdown after work until the bug is fixed. 2. Add a complex root passphrase and clean this up after the fix is released. 3. Reflect on how irresponsibly this serious security bug was ‘reported’, he didn’t just potentially miss out on $200,000, he put an enormous number of people at risk of local intrusions when instead if it was properly reporte…

It's not irresponsible to make a bug public.

He did not put people at risk, he showed people they are already at risk, so they would know to set a root password, and thereby not be at risk.

Security by obscurity does not work!