Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

491–500 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#491

Post by sitharus »

thomastjeffery wrote: post #365
Jedd wrote: post #239

Earlier quoted context omitted.

Not the case. Once you enable root access - by 'testing' this - others can remotely & silently access the system as root. GP is right - don't encourage people to test this, as there's nothing to gain from it. If you're on a shared machine you need to mitigate. If you're on your own dedicated machine you need to not share it until this is fixed.

> others can remotely & silently access the system as root. They already can: https://gfycat.com/gifs/detail/sentimentalnaiveantelopegroun...

This does not work if the root user has not been enabled locally.

Source: Just tried it myself.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#492

Post by thomastjeffery »

mrmondo wrote: post #480
thomastjeffery wrote: post #459

Earlier quoted context omitted.

The fact is that the devs certainly do know about it by now, yet users do not have a fix yet. Users do, however, have a workaround, and knowledge that the security flaw exists in the first place. Waiting for a fix before disclosing a security flaw is security by obscurity, even if it is to be replaced soon. It is best for users to know that their system is vulnerable, and how to fix that without waiting for a system…

> "The fact is that the devs certainly do know about it by now, yet users do not have a fix yet." Citation needed. > "It is best for users to know that their system is vulnerable, and how to fix that without waiting for a system update." Stepping outside the 'tech' social bubble, most general users likely won't create a root account and password from something they see on TV or their local news site or at least not b…

> Citation needed.

Has there been an update released yet? I wouldn't know, I don't use OS X.

Is this the best way to report a security flaw? Of course not! Is it a bad way? No! The only bad way to report a security flaw is to not report it at all.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#493

Post by martin-adams »

kreeWall wrote: post #362
thesephist wrote: post #183

Encouraging users to "try it" is dangerous here. Recreating the bug enables root user across the system, and most users won't know how to disable it. TechCrunch, if you're reading this... please discourage people from reproducing the bug.

Can you talk about how to correctly disable the root account if someone did try it?

If you're wondering how to disable it, the menu option can be found here: https://support.apple.com/en-gb/HT204012

Re: macOS High Sierra: Anyone can login as “root” with empty password

#494

Post by kifleswing »

bangonkeyboard wrote: post #303
tomduncalf wrote: post #266

I wonder what is going on with software quality and testing at Apple. It feels like recently there have been quite a few issues like this (the FileVault password bug, numerous issues with iOS 11, the issue that totally broke iOS Safari a couple of years ago) which should have been fairly easily caught, especially given the limited range of devices their software runs on. I know testing is hard, but a company with App…

macOS and iOS updates at Apple are now inextricably tied to new iPhone releases. There is a strict yearly deadline that the teams sprint toward, a timeline imposed by marketing rather than readiness. This affects prioritization of which features are pursued, where they lie in the stack, and how polished they get. Insufficient testing at today's Apple is not limited to software. They bragged about their extensive inpu…

Where did you hear that the keyboard was pulled from the channel? It just seems to be out of stock for me.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#495

Post by saagarjha »

bangonkeyboard wrote: post #164
patcheudor wrote: post #32

Apple makes it pretty easy to report vulnerabilities to: product-security@apple.com They also respond to security@apple.com but prefer the product-security address. Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed. Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even…

If you urgently want Apple to fix something, you do not file quiet bug reports. Apple only responds reliably to PR storms. This vulnerability is ridiculous, unacceptable, and braindead to execute.

You can go about it both ways: file a bug report, put a reasonable date that you want them to fix it by. Then you can disclose it.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#496

Post by thrusong »

milesokeefe wrote: post #481
thrusong wrote: post #452

There have been some really horrible bugs at Apple lately. I'm still waiting on them to patch the camera bug in iOS 11 where if you try to use the camera in a web app pinned to the home screen, it shows the camera UI on a black screen. This dates back to June. How can it be that hard to patch such a glaring and embarrassing problem?

How many people are using the camera in pinned web apps? What's the app you use? I'd imagine most camera-related functions are already best served by native apps.

Does that make it OK? I mean, something as important to the web as getUserMedia is broken on websites only if you pin it to the home screen. Forcing people into Apple's walled garden doesn't seem like an acceptable excuse.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#497

Post by ianmcgowan »

shoghicp wrote: post #136
ianmcgowan wrote: post #58

Confirming this works, both from preferences, as well as from the main login screen It seems like root has no password by default. Setting one is enough to close the hole. This is unbelievable! Curious to see what's in /var/db/dslocal/nodes/Default/users/root.plist before trying this.

These are the contents of the file, after converting them from binary plist to plain xml: https://gist.github.com/shoghicp/2b529b54b9d70daf192b68e3564...

Ah, there's no ShadowHashData or KerberosKeys nodes. Presumably the code creating that plist is not aware that later on it's going to be accessed thru layers of other software and end up as a usable login. To quote Shrek: "Software is like an onion".

Re: macOS High Sierra: Anyone can login as “root” with empty password

#498

Post by mozumder »

kristofferR wrote: post #148
patcheudor wrote: post #32

Apple makes it pretty easy to report vulnerabilities to: product-security@apple.com They also respond to security@apple.com but prefer the product-security address. Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed. Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even…

I really disagree - this needs to be reported as much as possible publicly to create a huge thunderstorm of negative publicity for Apple. This isn't the first extremely serious and dumb High Sierra password bug this year [1] [2], and unless Apple is severely hurt by it, so they're forced to change, it won't be the last. High Sierra is full of bugs and seemingly not just annoying bugs, but also security bugs. Let's ho…

Zero-day disclosures aren't about negative publicity in order to prevent problems further down the road some time in the distant future.

It's about protecting systems RIGHT NOW from immediately causing harm to people's lives.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#499

Post by saagarjha »

Veen wrote: post #403
jrochkind1 wrote: post #388

Earlier quoted context omitted.

they are? Where's the fix?

Create a root password.

This isn't a fix, it's a hack. A computer with a root password is inherently more insecure than one without a root account at all.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#500

Post by LeoPanthera »

tekacs wrote: post #399
LeoPanthera wrote: post #159

Earlier quoted context omitted.

You can simply set a root password with "sudo passwd" to close the hole.

And you might want to disable the root account again with `dsenableroot -d` as well, so that the root account stays disabled after the vulnerability is patched. Unlike doing this through the GUI, this seems to retain the root password and prevent this vuln from re-occuring.

Don't disable root. The bug re-enables it with a new blank password.
Post reply on HN