Are we really ready for self-driving cars? https://www.youtube.com/watch?v=4G1Boh-URIM
I will take malicious improper analogy for 100
macOS High Sierra: Anyone can login as “root” with empty password
51–60 of 1001 posts
Re: macOS High Sierra: Anyone can login as “root” with empty password
#52Confirmed on 10.13.1. As a workaround, once you login as "root", you can change the password to something else, and the empty password will stop working.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#53Are we really ready for self-driving cars? https://www.youtube.com/watch?v=4G1Boh-URIM
As a programmer, the thought terrifies me.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#54So — if you log out and log in as root without a password (EEK!), you can set your own password as root. Once you do, Mac os will no longer bypass the password.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#55Can this be used remotely? Edit: Yes, after turning on Remote Management on my second mac I was able to log into it using Remote Desktop, account root and no pw. It only works after getting physical access once.
[deleted]
Re: macOS High Sierra: Anyone can login as “root” with empty password
#56In the meantime, if you'd like to protect your mac, you can set a password for root by going to:
System Preferences > Users & Groups > Login Options > Join > Open Directory Utility > Edit > Change Root Password
Re: macOS High Sierra: Anyone can login as “root” with empty password
#57With user switching enabled as a username + password combo, I was able to login to the root account from the login screen with no password on 10.13.1. It's not just a UI bug, it's a full on authentication bypass.
I'm able to do this as well, login as root with no password from the login screen.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#58Confirming this works, both from preferences, as well as from the main login screen
It seems like root has no password by default. Setting one is enough to close the hole. This is unbelievable!
Curious to see what's in /var/db/dslocal/nodes/Default/users/root.plist before trying this.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#59Be careful testing this! It appears that you're creating a "root" superuser with no password. Be sure to clean up that user afterwords. https://twitter.com/a_hailes/status/935601901839806464
This support article explains how to disable the root user: https://support.apple.com/en-us/HT204012
Re: macOS High Sierra: Anyone can login as “root” with empty password
#60Wow. As if I needed another reason to never "upgrade" to High Sierra...
Apparently El Capitan is vulnerable too.