Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

451–460 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#451

Post by eridius »

2trill2spill wrote: post #126

Apple has a serious software quality problem. Last night I was helping a friend with their computer. Safari couldn't even render apples website correctly. Nor could Safari connect to any site with HTTPS. Installed FireFox and HTTPS sites worked and apples's site renders. But the submit button on their developer site is broken[1]. Mail on my Mom's fully updated laptop crashes every time it's opened. Once I reported a…

> Safari couldn't even render apples website correctly. Nor could Safari connect to any site with HTTPS.

Sounds like something's wrong with your friend's computer, because neither of those issues are reasonable to expect no matter what your opinion of Apple's software is.

> But the submit button on their developer site is broken

Given the number of people who've successfully gone through that form, I'm willing to bet it's a content blocker extension that's blocking some dependency the form needs.

> And now shipping an operating system with a root account with no password by default.

The OS actually ships with root disabled. The bug isn't that there's no password (after all, a factory-set password isn't any more secure), the bug is that the login form is somehow re-enabling the root user when it's not supposed to be able to do so.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#452

Post by thrusong »

There have been some really horrible bugs at Apple lately. I'm still waiting on them to patch the camera bug in iOS 11 where if you try to use the camera in a web app pinned to the home screen, it shows the camera UI on a black screen. This dates back to June. How can it be that hard to patch such a glaring and embarrassing problem?

Re: macOS High Sierra: Anyone can login as “root” with empty password

#453

Post by igetspam »

arghwhat wrote: post #206
igetspam wrote: post #28

Earlier quoted context omitted.

Linux != Ubuntu Linux didn't have that problem, a single vendor did. You could say the same for Apple except they are the single vendor. That stupid security trick in Ubuntu only impacts subset of a subset of Linux _desktop_ users which is a pretty small subset of computer users as a whole. When Apple does something like this, it impacts a much larger share of the world population. So how about we keep the snark to a…

As Linux user who does kernel-mode development for a living, root escalation bugs come a dime a dozen. And, well, Linux runs everything but the average persons laptop, so the impact, while different, is much greater. So lets keep the snark to an appropriate level, shall we?

Are you arguing that privilege escalation is the equivalent to passwordless root login? I mean, I guess you squint just right you could say that a logged out user having zero privileges being able to login as a user with all privileges is an "escalation" but that's one hell of a stretch. We haven't even gotten to snark yet though.

We can point to avenues for remote root all day but I don't recall any that are/were as simple as "just hit [enter] to get root" that impacts the shared attack surface that impacts all Linux systems.

NOTE: I did not go and search NVD before writing this reply but I did stay at a Holiday Inn Express once.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#454

Post by chris_7 »

skc wrote: post #439
yodsanklai wrote: post #425

Earlier quoted context omitted.

> But since I don't work there, I have no good inside info Actually, I've been wondering why I hear less about people working at Apple than at other big tech companies. It seems everyone and their mother work at Google or Facebook, but no so much at Apple. Do they have less software engineers, or their employees are required to be more discrete?

Apple probably doesn't take too kindly to their employees talking about their work. I'd imagine it's a fire-able offense.

it is everywhere else too, but people do quit...

Re: macOS High Sierra: Anyone can login as “root” with empty password

#455

Post by mikestew »

yodsanklai wrote: post #425
mikestew wrote: post #349

Earlier quoted context omitted.

Take this for the anecdata that it is. I interviewed at Apple, referred by old Microsoft friends that worked there. As I was trying to get a feel for things before the interview, I asked about the software testing. I was told, "don't expect what you're used to at Microsoft". The reference there is from when Microsoft often had more testers on a team than devs (ah, the good ol' days). The summary of what I was told by…

> But since I don't work there, I have no good inside info Actually, I've been wondering why I hear less about people working at Apple than at other big tech companies. It seems everyone and their mother work at Google or Facebook, but no so much at Apple. Do they have less software engineers, or their employees are required to be more discrete?

Do they have less software engineers, or their employees are required to be more discrete?

I know but a few that work at Apple, and of those few they strike me as less forthcoming than the multitudes I've worked with and know at Microsoft. I've wondered if part of that is because Microsoft previews/pre-announces just about everything, whereas Apple (mostly, and not so much anymore) announces it when the shipping trucks show up at the local Apple store.

So the outcome from the Microsoftie is, "it'll do this that and the other, but that's all I can say right now." From a recent conversation with an Apple employee: "they make me go in a special room to use the hardware, and I can't work from home. That's all I can say."

Probably more so, last I looked, Apple has considerably fewer software employees than the other big companies.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#456

Post by LeoPanthera »

tylerhou wrote: post #341
raydev wrote: post #300

I've been a developer for a long time. I understand bugs happen, even bugs with terrible consequences. A lot of bugs seem understandable, like I can see the chain of ifs/thens required to end up at some hilarious broken state. But I'm breaking my brain trying to figure out how in the hell a login attempt for "root" will enable it if it's disabled. Why is this is a possibility, to just enable root, no questions asked?

Another user suggested it may have to do with Apple’s new file system: https://news.ycombinator.com/item?id=15801643

You misunderstood. He's talking about a password hash storage system, not a filesystem.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#457

Post by [deleted] »

mikestew wrote: post #349
tomduncalf wrote: post #266

I wonder what is going on with software quality and testing at Apple. It feels like recently there have been quite a few issues like this (the FileVault password bug, numerous issues with iOS 11, the issue that totally broke iOS Safari a couple of years ago) which should have been fairly easily caught, especially given the limited range of devices their software runs on. I know testing is hard, but a company with App…

Take this for the anecdata that it is. I interviewed at Apple, referred by old Microsoft friends that worked there. As I was trying to get a feel for things before the interview, I asked about the software testing. I was told, "don't expect what you're used to at Microsoft". The reference there is from when Microsoft often had more testers on a team than devs (ah, the good ol' days). The summary of what I was told by…

[deleted]

Re: macOS High Sierra: Anyone can login as “root” with empty password

#459

Post by thomastjeffery »

mrmondo wrote: post #432
thomastjeffery wrote: post #400

Earlier quoted context omitted.

It's not irresponsible to make a bug public. He did not put people at risk, he showed people they are already at risk, so they would know to set a root password, and thereby not be at risk . Security by obscurity does not work !

It’s not an example of security by obscurity, it’s a straight out security flaw and bug. If it’s not publicly known and is a security risk it is far more effective to directly contact the developers / companies security team so they can immediately work on actually protecting people by developing a patch. If they don’t respond quickly (subjective, I’d call it within 12 hours) or fail to issue a fix in a timely manor…

The fact is that the devs certainly do know about it by now, yet users do not have a fix yet. Users do, however, have a workaround, and knowledge that the security flaw exists in the first place.

Waiting for a fix before disclosing a security flaw is security by obscurity, even if it is to be replaced soon.

It is best for users to know that their system is vulnerable, and how to fix that without waiting for a system update.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#460

Post by LeoPanthera »

thomastjeffery wrote: post #391
jonny_eh wrote: post #185

Looks like changing root’s password blocks the exploit but if you disable the root user, it re-enables the exploit. Protect yourself by changing root’s password: ⌘ (Command) + Space, Directory Utility, click the lock and enter your password, Edit -> Change Root Password…, then do NOT disable Root User. Or open a terminal and do: sudo passwd

sudo passwd Does that change the password for the current user without authentication, or does it change the password for root without authentication? I think it would be best to recommend an unambiguous sudo passwd root

"sudo foo" with no other arguments runs "foo" as root. "passwd" with no other arguments changes the password of the user it is running as.

"sudo passwd" unambiguously changes the password of root.

Post reply on HN