macOS High Sierra: Anyone can login as “root” with empty password • Hacker News Board

Re: macOS High Sierra: Anyone can login as “root” with empty password

#571

Post by oefrha » Tue, Nov 28, 2017, 10:57 PM UTC

minusSeven wrote: post #269

2trill2spill wrote: post #126

Apple has a serious software quality problem. Last night I was helping a friend with their computer. Safari couldn't even render apples website correctly. Nor could Safari connect to any site with HTTPS. Installed FireFox and HTTPS sites worked and apples's site renders. But the submit button on their developer site is broken[1]. Mail on my Mom's fully updated laptop crashes every time it's opened. Once I reported a…

Its not just Apple though. Microsoft had the similar problems in the past. Edge did not support silverlight causing people to move to other browser. It was strange to see Microsoft's own software not supported by Microsoft.

EdgeHTML sure has advanced a lot from Trident, and I appreciate their openness with Platform status, but Edge as a browser is still a joke IMO.

The other day I had to use vanilla Windows 10, and wanted to save a text file from Edge. Nope, there's no such functionality. The closest thing to save is print to PDF.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#572

Post by justadudeama » Tue, Nov 28, 2017, 10:57 PM UTC

michaelbuckbee wrote: post #402

jackhack wrote: post #395

Earlier quoted context omitted.

I'm more concerned that the "exploit" works "after a few tries" and not the first-time-every-time, or not at all. One would think that something as simple as a login would be deterministic.

My understanding is that the first attempt is creating/enabling the root account with a blank password and that the subsequent login is actually utilizing it (which is kind of bizarre and probably why this was missed in testing).

Does this user have admin privileges? root != admin on macOS if I recall correctly.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#573

Post by 5ilv3r » Tue, Nov 28, 2017, 10:57 PM UTC

quicklime wrote: post #43

Anyone else think it was a bad idea to disclose this so publicly over Twitter? I thought that the usual practice was to let the development team know first.

Time and time again we have been shown that the way to a company's heart is through it's PR department. This is a dev complaining to Apple like a lunchgoer would complain to Mc D's about a bad burger. Expect more of it.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#574

Post by thomastjeffery » Tue, Nov 28, 2017, 10:58 PM UTC

albertTJames wrote: post #556

patcheudor wrote: post #32

Apple makes it pretty easy to report vulnerabilities to: product-security@apple.com They also respond to security@apple.com but prefer the product-security address. Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed. Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even…

Yeah, the guy is an attention whore, he just wants to buzz. There is no justification for releasing a 0day publicly.

There is a simple workaround. Publicity means security here.

It's trivial to find. He can't presume he is the only one who found it. Telling any individual that doesn't have malicious intent is a good thing, therefore telling everyone is a good thing.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#575

Post by OkGoDoIt » Tue, Nov 28, 2017, 10:58 PM UTC

raydev wrote: post #300

I've been a developer for a long time. I understand bugs happen, even bugs with terrible consequences. A lot of bugs seem understandable, like I can see the chain of ifs/thens required to end up at some hilarious broken state. But I'm breaking my brain trying to figure out how in the hell a login attempt for "root" will enable it if it's disabled. Why is this is a possibility, to just enable root, no questions asked?

Seems to be something related to a backwards-compatibility code path for upgraded systems. According to multiple posts on this thread it only affects systems upgraded to High Sierra, not fresh installs. See https://news.ycombinator.com/item?id=15802622 for example. Adding extra layers for compatibility complicates testing and debugging. With this many eyes on it hopefully someone will be able to deduce exactly what's going on.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#576

Post by thomastjeffery » Tue, Nov 28, 2017, 10:59 PM UTC

notanai wrote: post #285

LeoPanthera wrote: post #142

Earlier quoted context omitted.

It's not local if you have Remote Desktop enabled. Works over that too. From there you can enable ssh and all bets are off.

"It only works after getting physical access once" - quote form somewhere else in the thread

...or if you enabled root for some reason, but didn't set a password.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#577

Post by mwfunk » Tue, Nov 28, 2017, 10:59 PM UTC

lawnchair_larry wrote: post #373

fixermark wrote: post #121

Earlier quoted context omitted.

Is it likely it's just an error due to the discoverer not being immersed in the Infosec space? "Don't disclose a 0-day publicly" is good 'common' sense, but only among the 'common' of people who are steeped in security issues and the ramifications of publicizing them.

That is not the case among infosec professionals either. Many respected professionals believe that the right thing to do in many cases is full public disclosure. Google Project Zero are a notable example.

Google Project Zero does not support full public disclosure immediately- quite the opposite. They support full public disclosure after giving the vendor an opportunity to ship a fix to their customers in a reasonable period of time. Nobody's debating whether or not security flaws should be publicly disclosed- of course they should. The only debate is, what is the most responsible way to handle such a security issue such that it harms the fewest users.

Project Zero (and infosec professionals, at least all of the ones I've ever worked with) would tell you that this was the most irresponsible way to handle the issue, short of not saying anything and selling knowledge of the exploit to someone other than the vendor who could fix it. Publicizing something like this in this way is something people do because they want publicity for themselves. It is not something someone does if their biggest concern is for the users who might be affected by it. It is something someone would do if they didn't care about the users, and just wanted public credit for pointing it out.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#578

Post by mcbridematt » Tue, Nov 28, 2017, 10:59 PM UTC

legohead wrote: post #301

jeffisabelle wrote: post #154

I still can't believe more people complain about this being publicly disclosed than this being possible in the first place. No one is obligated to know the procedures on InfoSec 0-days and follow those steps.

I wouldn't bash the guy. Someone already let him know about his technical faux pas in a professional manner on his twitter. My guess is he found this vulnerability on accident, freaked out, and tweeted about it. Probably has limited infosec experience.

Definitely. How many people outside the infosec industry know that responsible disclosure channels exist?

Re: macOS High Sierra: Anyone can login as “root” with empty password

#579

Post by CGamesPlay » Tue, Nov 28, 2017, 11:00 PM UTC

notanai wrote: post #13

Can this be used remotely? Edit: Yes, after turning on Remote Management on my second mac I was able to log into it using Remote Desktop, account root and no pw. It only works after getting physical access once.

You can get undetectble remote access on most machines given "physical access once", so I don't think this qualifies as "remotely exploitable".

Re: macOS High Sierra: Anyone can login as “root” with empty password

#580

Post by giancarlostoro » Tue, Nov 28, 2017, 11:00 PM UTC

michaelbuckbee wrote: post #402

jackhack wrote: post #395

Earlier quoted context omitted.

I'm more concerned that the "exploit" works "after a few tries" and not the first-time-every-time, or not at all. One would think that something as simple as a login would be deterministic.

My understanding is that the first attempt is creating/enabling the root account with a blank password and that the subsequent login is actually utilizing it (which is kind of bizarre and probably why this was missed in testing).

The first time I tried it, it just worked. I'm certain I've used root before. On the GUI portion it works with no password, but on the terminal it does not let me login as root without a password. Some weird OS magic must be going on there?