Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

441–450 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#441

Post by ben_w »

wonderous wrote: post #306
tomduncalf wrote: post #266

I wonder what is going on with software quality and testing at Apple. It feels like recently there have been quite a few issues like this (the FileVault password bug, numerous issues with iOS 11, the issue that totally broke iOS Safari a couple of years ago) which should have been fairly easily caught, especially given the limited range of devices their software runs on. I know testing is hard, but a company with App…

Apple has always had QA issues, the difference now is that they’re increasingly tested by the users, hackers, etc.

Difference? MacOS userbase hasn’t changed much since 2011, I thought?

Re: macOS High Sierra: Anyone can login as “root” with empty password

#443

Post by hw »

kristofferR wrote: post #148
patcheudor wrote: post #32

Apple makes it pretty easy to report vulnerabilities to: product-security@apple.com They also respond to security@apple.com but prefer the product-security address. Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed. Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even…

I really disagree - this needs to be reported as much as possible publicly to create a huge thunderstorm of negative publicity for Apple. This isn't the first extremely serious and dumb High Sierra password bug this year [1] [2], and unless Apple is severely hurt by it, so they're forced to change, it won't be the last. High Sierra is full of bugs and seemingly not just annoying bugs, but also security bugs. Let's ho…

Why does it need to create a lot of negative publicity for Apple? Is there something you don't like about them? Responsible disclosure needs to be valued given the number of macs out there in the wild that could potentially be susceptible to issues like this, and the impact it could have on people (including you) not just directly but indirectly.

How would you feel if someone discovered a 0day at a company that exposes credit card and identity info, published the 0day, then hackers steal all that info (including yours)? I'm sure 'creating a thunderstorm of negative publicity' would be the last thing you would want.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#444

Post by wil421 »

yodsanklai wrote: post #425
mikestew wrote: post #349

Earlier quoted context omitted.

Take this for the anecdata that it is. I interviewed at Apple, referred by old Microsoft friends that worked there. As I was trying to get a feel for things before the interview, I asked about the software testing. I was told, "don't expect what you're used to at Microsoft". The reference there is from when Microsoft often had more testers on a team than devs (ah, the good ol' days). The summary of what I was told by…

> But since I don't work there, I have no good inside info Actually, I've been wondering why I hear less about people working at Apple than at other big tech companies. It seems everyone and their mother work at Google or Facebook, but no so much at Apple. Do they have less software engineers, or their employees are required to be more discrete?

Could it be the level of secrecy around Apple? I see responses for Google and Facebook devs on HN a lot but never Apple.

The only people I know locally that work for Apple are remote customer support folks.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#445

Post by bradrydzewski »

sydney6 wrote: post #437
bradrydzewski wrote: post #379

Earlier quoted context omitted.

Responsible disclosure does not prevent negative publicity. It provides the vendor with a grace period during which they can fix the vulnerability. There can be plenty of negative publicity once the vulnerability is patched and publicly disclosed. Encouraging irresponsible disclosure because one wants to see Apple hurt is a reckless and selfish attitude because it puts millions of Apple customers at risk in the proce…

Not the attitude of the people reporting the issue have put "millions of apple customers" at risk, but the company which allowed to let issues like this one slip through their Q&A process. IMO, this behaviour is part of the problem, the reason why tech companies take security only on a superfiscial level seriously. Don't kill the Messenger.

I think this incorrectly interprets my comment. I am not defending apple or blaming the individual that disclosed the vulnerability on Twitter. I am simply pointing out that putting users at additional risk because you want to see Apple hurt may be misguided. We have responsible disclosures in place for a reason.

EDIT: putting users at _additional_ risk

Re: macOS High Sierra: Anyone can login as “root” with empty password

#446

Post by ehntoo »

djrogers wrote: post #331
valine wrote: post #227

Earlier quoted context omitted.

It works remotely if remote login is enable. edit: Screen sharing is is vulnerable not ssh. Either way its bad.

No it does not. I tested this rather carefully, and both ssh and screen sharing do not allow the user root with no password.

I have not been able to trigger this with ssh, but certainly have been able to with Screen Sharing, even after explicitly re-disabling the root account.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#447

Post by nolok »

davidkuhta wrote: post #345
bsaul wrote: post #224

I wonder who they're going to ask to write a public letter of apology this time. This isn't just a snarky comment. They have just released the most awfull iOS upgrade for a long time, and now this. Something's messed up, and they better fix it soon. I've think i've read somewhere they merged the iOS and macOS teams, i suppose the wrong people were promoted during the operation.

Cue "incorrect elevation of privileges" joke. sudo laugh edit: spelling

Nah you don't need sudo for that anymore, now you're root

Re: macOS High Sierra: Anyone can login as “root” with empty password

#448

Post by fixermark »

overcast wrote: post #287
fixermark wrote: post #174

Earlier quoted context omitted.

When I put it into my personal malice / ignorance balance, it weighs out to the likelihood that the discloser isn't plugged in enough to the infosec scene to be aware that there are already best practices for this kind of disclosure. It's a big world out there, especially nowadays. And nothing I've seen in recent history suggests to me the average user knows or cares about infosec concerns beyond basic hindsight unde…

Sure, now look at his Twitter account. He looks pretty plugged into the software community. Agile Software Craftsman, iyzicoder @ http://www.iyzico.com , Founder of Software Craftsmanship Turkey @scturkey, The community guy http://bit.ly/lemiorhan

Yes. And from his personal site [http://www.lemiorhanergin.com/]:

He's a manager. CSM, PSM1, PSD1, Scrum Master, Kanban Practitioner. Code retreat facilitator. Translated Agile Manifesto into Turkish. The only thing that immediately makes me think he even touches code is "git trainer and lover." Notably lacking from his résumé: references to specific open source projects he's worked on or code he's written (though personally, I'd be concerned because his résumé does list "Restful Services" and I'd expect that to have given him a taste of infosec basics, but maybe it's a bit of résumé padding... shouldn't it be spelled "RESTful services?" ;) ).

It feels weird to say for those of us deeply immersed in the internet / telecoms / web app side of software development, but depending on your focus, you can do an awful lot of software development without ever brushing up against the sharp edge of infosec.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#449

Post by rgrove »

perfectstorm wrote: post #389

What's going on with Apple's QA team ? Here's another serious bug that I came across: I've two factor authentication on my Apple account and now every time I use a new browser (or after clearing the Cache) and try to log into one of the Apple developer sites it sends me the authentication code to the same machine that I'm using. How is that two factor ? I've an iPhone which is connected to the same account but it's n…

> I've two factor authentication on my Apple account and now every time I use a new browser (or after clearing the Cache) and try to log into one of the Apple developer sites it sends me the authentication code to the same machine that I'm using. How is that two factor?

Your password is something you know. Your computer (which is associated with your Apple ID) is something you have.

If someone tries to log in using your password from another computer, your account is safe. If someone steals your computer but doesn't know your password, your account is safe. You're only in trouble if someone steals your computer _and_ knows your password.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#450

Post by bsaul »

rimliu wrote: post #329
bsaul wrote: post #224

I wonder who they're going to ask to write a public letter of apology this time. This isn't just a snarky comment. They have just released the most awfull iOS upgrade for a long time, and now this. Something's messed up, and they better fix it soon. I've think i've read somewhere they merged the iOS and macOS teams, i suppose the wrong people were promoted during the operation.

> They have just released the most awfull iOS upgrade for a > long time, and now this. Something's messed up, and they > better fix it soon. I keep seeing this written after each major iOS release sinc at least iOS 7.

For me, the most painful is that this time they managed to screw up the damn keyboard while bringing absolutely nothing new. I can't even use hangout or chat on my iPad Air , i have to wait 3 seconds for my words to appear.

That's just wrong. There's no excuse for that. We're not talking about fancy animation or new features that we think aren't a great idea. Just a basic regression on one of the most fundamental things you can do with this device (the other being displaying things).

Another thing is that they usually fix slowdowns and stability with the following release soon after. Not this time, so my guess is that it'll be a "change your device" kind of upgrade.

Post reply on HN