Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

541–550 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#541

Post by pishpash »

dec0dedab0de wrote: post #370
raydev wrote: post #300

I've been a developer for a long time. I understand bugs happen, even bugs with terrible consequences. A lot of bugs seem understandable, like I can see the chain of ifs/thens required to end up at some hilarious broken state. But I'm breaking my brain trying to figure out how in the hell a login attempt for "root" will enable it if it's disabled. Why is this is a possibility, to just enable root, no questions asked?

I'm having a hard time understanding how this could happen too. It would have to be that looking up the root account enabled it, maybe users go dormant or something, and this was a way to readd them? then once it was enabled it defaulted to a blank password, but you would think that it needs sudo to enable root in the first place.

Not only enabled it but actually set an empty-string password. Usually the stored hash for a disabled account is not in the hash space, so it was either overwritten, or root account password was actually empty string out of the factory. That and the enabling of the account both point to debug code accidentally left in (or intentional backdoor by the disgruntled).

Re: macOS High Sierra: Anyone can login as “root” with empty password

#542

Post by jsmthrowaway »

arghwhat wrote: post #263
AdamJacobMuller wrote: post #242

Earlier quoted context omitted.

The root account always exists. Playing around with disable/enable and the exploit: Root always has a /bin/sh shell "Disable root user" removes the ShadowHashData from the directory services entry for root The bug sets ShadowHashData to the hash of an empty string. Now, ShadowHashData is a complex DS entry. I've never seen passwords represented this way in other OSX versions. I think this password storage format is n…

Your comment suggests that it is related to users with older, pre-High Sierra directory entries. That is, upgraded rather than freshly installed machines that leave older, pre-ShadowHashData intact. Is this correct?

No, I reproduced on freshly-installed High Sierra on two machines.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#544

Post by e5an »

thanatropism wrote: post #369
2trill2spill wrote: post #337

Earlier quoted context omitted.

It seems apple's software has been trending down in quality since Snow Leopard.

I'll agree that Snow Leopard is the high water-mark.

It can't be a coincidence that this was the last major release before Steve Jobs died.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#545

Post by ukblewis »

pilsetnieks wrote: post #347
sephicr wrote: post #320

Earlier quoted context omitted.

Yes, but the most secure thing to do at this point _is_ to recreate the bug and then set a password for the root user. Otherwise the hole is still there for others to exploit.

If you set a root password, this bug still works, it seems to reset the root password. Edit: I was partly wrong. The bug still works if you disable root afterwards, then it reenables and resets it.

Yeah, you’re safe if you keep the foot account alive and you set a password for root. At least as far as I can tell...

Re: macOS High Sierra: Anyone can login as “root” with empty password

#546

Post by joe_the_user »

bradrydzewski wrote: post #379
kristofferR wrote: post #148

Earlier quoted context omitted.

I really disagree - this needs to be reported as much as possible publicly to create a huge thunderstorm of negative publicity for Apple. This isn't the first extremely serious and dumb High Sierra password bug this year [1] [2], and unless Apple is severely hurt by it, so they're forced to change, it won't be the last. High Sierra is full of bugs and seemingly not just annoying bugs, but also security bugs. Let's ho…

Responsible disclosure does not prevent negative publicity. It provides the vendor with a grace period during which they can fix the vulnerability. There can be plenty of negative publicity once the vulnerability is patched and publicly disclosed. Encouraging irresponsible disclosure because one wants to see Apple hurt is a reckless and selfish attitude because it puts millions of Apple customers at risk in the proce…

A bug like 'can log in with password "root"/""' just isn't going to get you a grace period no matter what security researchers might want.

I mean, this bugs has been reported already - by every cheesy hacking movie ever, by every beginners book on social engineering and so-forth. Heck, it was "reported" by Richard Feynman talking about cracking safes during the Manhattan.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#547

Post by 2trill2spill »

eridius wrote: post #451
2trill2spill wrote: post #126

Apple has a serious software quality problem. Last night I was helping a friend with their computer. Safari couldn't even render apples website correctly. Nor could Safari connect to any site with HTTPS. Installed FireFox and HTTPS sites worked and apples's site renders. But the submit button on their developer site is broken[1]. Mail on my Mom's fully updated laptop crashes every time it's opened. Once I reported a…

> Safari couldn't even render apples website correctly. Nor could Safari connect to any site with HTTPS. Sounds like something's wrong with your friend's computer, because neither of those issues are reasonable to expect no matter what your opinion of Apple's software is. > But the submit button on their developer site is broken Given the number of people who've successfully gone through that form, I'm willing to bet…

> Sounds like something's wrong with your friend's computer, because neither of those issues are reasonable to expect no matter what your opinion of Apple's software is.

Doubtful Firefox and Chrome work just fine.

> Given the number of people who've successfully gone through that form, I'm willing to bet it's a content blocker extension that's blocking some dependency the form needs.

Brand new install of Mac OS on a new SSD. So Safari was clean no extensions, no custom configuration.

> The OS actually ships with root disabled. The bug isn't that there's no password (after all, a factory-set password isn't any more secure), the bug is that the login form is somehow re-enabling the root user when it's not supposed to be able to do so.

Mere semantics, It doesn't matter if root is being "reenabled" or not. From an attackers point of view High Sierra effectively ships with root with no password.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#548

Post by saagarjha »

bsaul wrote: post #450
rimliu wrote: post #329

Earlier quoted context omitted.

> They have just released the most awfull iOS upgrade for a > long time, and now this. Something's messed up, and they > better fix it soon. I keep seeing this written after each major iOS release sinc at least iOS 7.

For me, the most painful is that this time they managed to screw up the damn keyboard while bringing absolutely nothing new. I can't even use hangout or chat on my iPad Air , i have to wait 3 seconds for my words to appear. That's just wrong. There's no excuse for that. We're not talking about fancy animation or new features that we think aren't a great idea. Just a basic regression on one of the most fundamental thi…

> I can't even use hangout or chat on my iPad Air , i have to wait 3 seconds for my words to appear.

Obviously, something's wrong with your keyboard, but how do you know it's iOS's fault instead of your app's?

Re: macOS High Sierra: Anyone can login as “root” with empty password

#550

Post by saagarjha »

_jomo wrote: post #200

Current workaround / fix: 1) open Directory Utility app (via Spotlight or other) 2) Click lock to make changes, log in with admin account 2) Click Edit -> Enable Root User 3) Click Edit -> Change Root Password… 4) Set a password 5) Do NOT disable root user! If you disable the root user, the admin prompt will create it again with an empty password.

Once the fix for this issue is out, you should disable the root user.
Post reply on HN