Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

581–590 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#581

Post by runesoerensen »

Apple suggests the workaround also discussed in this thread until the issue is fixed:

"We are working on a software update to address this issue. In the meantime, setting a root password prevents unauthorized access to your Mac. To enable the Root User and set a password, please follow the instructions here: https://support.apple.com/en-us/HT204012. If a Root User is already enabled, to ensure a blank password is not set, please follow the instructions from the ‘Change the root password’ section."

https://techcrunch.com/2017/11/28/astonishing-os-x-bug-lets-...

Re: macOS High Sierra: Anyone can login as “root” with empty password

#582

Post by giancarlostoro »

justadudeama wrote: post #572
michaelbuckbee wrote: post #402

Earlier quoted context omitted.

My understanding is that the first attempt is creating/enabling the root account with a blank password and that the subsequent login is actually utilizing it (which is kind of bizarre and probably why this was missed in testing).

Does this user have admin privileges? root != admin on macOS if I recall correctly.

root IS an admin in macOS. You just cannot use root the same way you expect root to work in other Unix OS' without changing stuff in the BIOS (or whatever it's called for Apple) but you can still do most admin things with root. However root does get admin privileges, but when it comes to some system directories he is banned till you "fix" root privileges.

Edit:

See: https://stackoverflow.com/a/33272796 for a bit more information of what I mean.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#583

Post by IBM »

thanatropism wrote: post #369
2trill2spill wrote: post #337

Earlier quoted context omitted.

It seems apple's software has been trending down in quality since Snow Leopard.

I'll agree that Snow Leopard is the high water-mark.

It's common among a small group of Mac users to hold Snow Leopard up as the peak of software quality, but only because of rose-colored glasses [1].

[1] https://www.computerworld.com/article/2528936/mac-os-x/snow-...

Re: macOS High Sierra: Anyone can login as “root” with empty password

#584

Post by 5ilv3r »

saagarjha wrote: post #531
zeveb wrote: post #220

Earlier quoted context omitted.

> I still can't believe more people complain about this being publicly disclosed than this being possible in the first place. I think the problem is due to the fact that they are fans. In this case, it's Apple, but there's no reason it couldn't be Linux or Go or whatever. Regardless, any bad news about their hero is irresponsible to disseminate. We see this same phenomenon in politics, in sports and elsewhere — I dar…

> I think the problem is due to the fact that they are fans. I think this is an unfair characterization. Sure, it's hard to hear that their "hero is irresponsible", but the real reason is that this kind of behavior puts everyone at risk while Apple tries to fix it.

That may be true for cisco and juniper where upgrades must be carefully rolled out across globally distributed critical infrastructure, but this is APPLE. They need no such help. They can push to everyone, now, and it will be fine. Forcing their hand is safer than trying to hide a flaw a 3 year old could find on accident.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#585

Post by markdog12 »

2trill2spill wrote: post #126

Apple has a serious software quality problem. Last night I was helping a friend with their computer. Safari couldn't even render apples website correctly. Nor could Safari connect to any site with HTTPS. Installed FireFox and HTTPS sites worked and apples's site renders. But the submit button on their developer site is broken[1]. Mail on my Mom's fully updated laptop crashes every time it's opened. Once I reported a…

Paid $3,000 for an iMac. Can't even watch any video or have the kids FaceTime their grandparents because video freezes constantly. Rebooting fixes it...for 2 minutes.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#586

Post by wuliwong »

saagarjha wrote: post #499
Veen wrote: post #403

Earlier quoted context omitted.

Create a root password.

This isn't a fix, it's a hack. A computer with a root password is inherently more insecure than one without a root account at all.

Seems like you are splitting hairs here. Clearly, the point the commenter was making is that people that have now set the root password as a result of the tweet are more secure than they were before the tweet.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#587

Post by thomastjeffery »

saagarjha wrote: post #513
williamscales wrote: post #383

Earlier quoted context omitted.

This situation is much more akin to a fire rapidly spreading through a village at night. I would go outside and start hollering in the hopes of saving anyone.

A better analogy is that there's a fire somewhere in your village, but it's mostly contained (it's not spreading, because other people don't know about it yet). By hollering about it, you've made it possible for anyone to go to the fire, light a torch with it, and burn down the village. Instead, you could call up the fire department and they could put it out–and then you could tell everyone about it.

> you've made it possible for anyone to go to the fire, light a torch with it

And at the same time provided everyone with a simple, free, and perfect way to fireproof his/her house.

You could wait for the fire department, which may take hours to get there, and hope that no malicious party down the street saw the fire, or you can do this. It turns out that both are quite reasonable reactions in this scenario, and that the latter is much more obvious to the layman.

There is no good reason to get angry at the layman for taking a course you don't prefer.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#588

Post by submeta »

abritishguy wrote: post #534

Just in case it is relevant for anyone here this is what our security team have established thus far: - Can be mitigated by enabling the root user with a strong password - Can be detected with `osquery` using `SELECT * FROM plist WHERE path = "/private/var/db/dslocal/nodes/Default/users/root.plist" AND key = "passwd" AND length(value) > 1;";` - You can see what time the root account was enabled using `SELECT * FROM p…

Excellent! Thanks for sharing

Re: macOS High Sierra: Anyone can login as “root” with empty password

#589

Post by eridius »

2trill2spill wrote: post #547
eridius wrote: post #451

Earlier quoted context omitted.

> Safari couldn't even render apples website correctly. Nor could Safari connect to any site with HTTPS. Sounds like something's wrong with your friend's computer, because neither of those issues are reasonable to expect no matter what your opinion of Apple's software is. > But the submit button on their developer site is broken Given the number of people who've successfully gone through that form, I'm willing to bet…

> Sounds like something's wrong with your friend's computer, because neither of those issues are reasonable to expect no matter what your opinion of Apple's software is. Doubtful Firefox and Chrome work just fine. > Given the number of people who've successfully gone through that form, I'm willing to bet it's a content blocker extension that's blocking some dependency the form needs. Brand new install of Mac OS on a…

> Doubtful Firefox and Chrome work just fine.

That doesn't mean anything. It just means that whatever is messed up affects Safari. It's not like the computer recognizes "oh those 3 apps are all web browsers, therefore if I'm going to screw one of them up, I have to screw them all up". Your claim would carry more weight if you were listing multiple browsers that all use the same system-provided WebKit.framework, but Firefox and Chrome are completely separate browsing engines.

Regarding the HTTPS issue, I believe Firefox and Chrome maintain their own list of root certs, so one possible way the computer could be screwed up is having the system-managed root cert list be damaged (you didn't specify what actually happens when trying to connect to HTTPS sites so I don't know if this is actually a plausible cause in this particular case).

> Brand new install of Mac OS on a new SSD. So Safari was clean no extensions, no custom configuration.

Well I don't know what to tell you, except to point out that there's, what, hundreds of thousands of registered Apple developers now? who've all had to go through that form, and there's only a handful of people on that thread, so it's far more likely to be a local issue.

Post reply on HN