Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

61–70 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#61

Post by cortesoft »

anon1253 wrote: post #24

wat. confirmed on 10.13.1 (17B48). I was even able to add another super user. Edit: changing the login method to "Name and password" under login options, then logout and login with "root" with empty password also works. Fortunately, it doesn't work on cold boot with FileVault enabled, at least it doesn't appear so. `sudo su root` also doesn't work with an empty password.

well, `sudo su root` would be using the user password for the logged in user, not for root. Does `su root` work, with no password at the prompt?

Re: macOS High Sierra: Anyone can login as “root” with empty password

#64

Post by cotillion »

myth_buster wrote: post #16

Is social media the goto for reporting security vulnerabilities in 2017? If I remember correctly, one is supposed to make it public once patched or in event of no response, no? Edit: What is "Responsible Disclosure"[0]? [0] https://en.wikipedia.org/wiki/Responsible_disclosure

This is one of those cases where responsible disclosure just means you're doing the job one of apples automated tests should be doing.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#66

Post by MentallyRetired »

tombrossman wrote: post #15

Fellow Linux users, please keep the snark in this thread to a minimum. Here's just one recent example why, there are more: http://www.omgubuntu.co.uk/2017/05/ubuntu-guest-sessions-log...

Hypocrisy is a reason to keep snark at a minimum?

Re: macOS High Sierra: Anyone can login as “root” with empty password

#68

Post by tempay »

mschuster91 wrote: post #50
jcoby wrote: post #38

Be careful testing this! It appears that you're creating a "root" superuser with no password. Be sure to clean up that user afterwords. https://twitter.com/a_hailes/status/935601901839806464

The "root" superuser is always there, I'm not sure if it's possible to actually delete it.

It is disabled by default[1] (meaning you can't login as it), this vulnerability appears to enable the root user without setting a password. If the root user has already been enabled it doesn't work.

Anyone who does this should probably set a password for now and then disable the root user account once it has been patched.

[1] https://support.apple.com/en-us/HT204012

Re: macOS High Sierra: Anyone can login as “root” with empty password

#69

Post by glhaynes »

MentallyRetired wrote: post #53
michaelmcmillan wrote: post #21

Are we really ready for self-driving cars? https://www.youtube.com/watch?v=4G1Boh-URIM

As a programmer, the thought terrifies me.

As someone who tries to do risk analysis, the prospect of sticking with human drivers because of fear of software bugs (which inevitably will kill, just in much smaller numbers) terrifies me.
Post reply on HN