Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

531–540 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#531

Post by saagarjha »

zeveb wrote: post #220
jeffisabelle wrote: post #154

I still can't believe more people complain about this being publicly disclosed than this being possible in the first place. No one is obligated to know the procedures on InfoSec 0-days and follow those steps.

> I still can't believe more people complain about this being publicly disclosed than this being possible in the first place. I think the problem is due to the fact that they are fans. In this case, it's Apple, but there's no reason it couldn't be Linux or Go or whatever. Regardless, any bad news about their hero is irresponsible to disseminate. We see this same phenomenon in politics, in sports and elsewhere — I dar…

> I think the problem is due to the fact that they are fans.

I think this is an unfair characterization. Sure, it's hard to hear that their "hero is irresponsible", but the real reason is that this kind of behavior puts everyone at risk while Apple tries to fix it.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#534

Post by abritishguy »

Just in case it is relevant for anyone here this is what our security team have established thus far:

- Can be mitigated by enabling the root user with a strong password

- Can be detected with `osquery` using `SELECT * FROM plist WHERE path = "/private/var/db/dslocal/nodes/Default/users/root.plist" AND key = "passwd" AND length(value) > 1;";`

- You can see what time the root account was enabled using `SELECT * FROM plist WHERE path = "/private/var/db/dslocal/nodes/Default/users/root.plist" WHERE key = "accountPolicyData";` then base 64 decoding that into a file and then running `plutil -convert xml1` and looking at the `passwordLastSetTime` field.

Note: osquery needs to be running with `sudo` but if you have it deployed across a fleet of macs as a daemon then it will be running with `sudo` anyway.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#535

Post by revmoo »

collinmanderson wrote: post #413
sillysaurus3 wrote: post #87

Earlier quoted context omitted.

It's the neighborly thing to do, but people are under no obligation to report vulns privately. The blame lies squarely on Apple, not on the messenger. The fact that we know about it means we can take steps to mitigate the damage.

Mostly, they're just missing out on an up to $200,000 bug bounty. https://www.theregister.co.uk/2016/08/05/apple_joins_the_bug...

> Invite only

LMAO. It's called a "job"

Re: macOS High Sierra: Anyone can login as “root” with empty password

#536

Post by saagarjha »

spsful wrote: post #530

workaround: ENABLE ROOT USER AS FAST AS POSSIBLE https://support.apple.com/en-us/HT204012

As I had said above, this, in the long run, is actually less secure than not having a root account at all. If you do this, make sure to revert it once the issue is patched.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#537

Post by mk89 »

zach43 wrote: post #422
raydev wrote: post #300

I've been a developer for a long time. I understand bugs happen, even bugs with terrible consequences. A lot of bugs seem understandable, like I can see the chain of ifs/thens required to end up at some hilarious broken state. But I'm breaking my brain trying to figure out how in the hell a login attempt for "root" will enable it if it's disabled. Why is this is a possibility, to just enable root, no questions asked?

Maybe something like this was added to make debugging/testing of the OS easier? maybe they just forgot to remove it before shipping the new macOS

That could be the case - I can't find any other possible logical explanation, because it doesn't make any sense.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#538

Post by saagarjha »

2trill2spill wrote: post #529

Besides for APFS what user visible killer features has Apple made to Mac OS since 10.6.8? I'm sure they have made internal non user visible improvements to their kernel and userland. But it seems most of the "changes" to Mac OS is just churning code, or at least it seems that way from the outside. To me personally 10.6.8 + Security Updates + APFS is extremely close to the ideal operating system.

APFS is not an example of something I would consider "user visible"–for the average user there's no difference between HFS+ and APFS.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#539

Post by maxxxxx »

nikofeyn wrote: post #430
bangonkeyboard wrote: post #303

Earlier quoted context omitted.

macOS and iOS updates at Apple are now inextricably tied to new iPhone releases. There is a strict yearly deadline that the teams sprint toward, a timeline imposed by marketing rather than readiness. This affects prioritization of which features are pursued, where they lie in the stack, and how polished they get. Insufficient testing at today's Apple is not limited to software. They bragged about their extensive inpu…

it is also that they pursue features just for the sake of it. things get moved arund in the iPad from release to release for no good reason, often going backwards in usability. every release i have to relearn simple things like how to manage the screen brightness. i really wonder what they are thinking internally other than “we need to shake things up to make it appear we’re doing something with stale products”.

It seems phones and tablets have reached the stage where laptops were maybe 15 years ago. All the major features are done and innovation is pretty much over. So they have to make a lot of cosmetic changes that look like activity.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#540

Post by butterisgood »

Doesn't work for me on a freshly installed MacOS High Sierra, but does work on an upgraded laptop to High Sierra.

Interesting...

Also the UX is different. Typing root on the fresh installed one fails, then resets the user text box to my name, and if I type root again it doesn't let me it.

On the upgraded laptop, if I type root, it sticks and clicking unlock twice gets me in.

Post reply on HN