Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

621–630 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#621

Post by mbesto »

legohead wrote: post #301
jeffisabelle wrote: post #154

I still can't believe more people complain about this being publicly disclosed than this being possible in the first place. No one is obligated to know the procedures on InfoSec 0-days and follow those steps.

I wouldn't bash the guy. Someone already let him know about his technical faux pas in a professional manner on his twitter. My guess is he found this vulnerability on accident, freaked out, and tweeted about it. Probably has limited infosec experience.

I don't know, he's tweeted more about the topic: https://twitter.com/lemiorhan/status/935619881143324673

So he's either not reading his replies or he's being deliberately irresponsible. My guess, based on his profile and online behavior, is that he's trying to ride the coattails of getting some exposure online.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#622

Post by 5ilv3r »

saagarjha wrote: post #567
5ilv3r wrote: post #560

Earlier quoted context omitted.

You are comparing an arsonist to a fire department.

Uhh, no. How are you getting that impression? I'm simply saying that arsonists exist, and it's probably a good idea to make it harder for them to burn things down than to publicly advertise a way for them to do it.

Do you live in some horrible place where your neighbors will throw gas on your burning house unless you can quickly and quietly get the fire department there first, to put out the fire that the FIRE DEPARTMENT started?

Dude. That was your example.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#623

Post by EGreg »

asejfwe8823 wrote: post #270
e40 wrote: post #102

Earlier quoted context omitted.

The blame lies squarely on Apple, not on the messenger. There is blame on both. If you leave your key in your front door lock and I blast out on twitter your address and tell people about it, I think I have some responsibility.

A better analogy would be "if the lending bank left the door to your new house open..." Other than buy an Apple product, the users did nothing intentional to undermine security. Since this is a subjective argument, based more on historical instances of "responsible disclosure" and not law, I'm gonna lean in this case of it being Apple that failed They built the entire "walled garden" without getting outside help. The…

Exactly.

Responsible disclosure is an interesting concept. How does this kind of disclosure make sure that the public knows about a company's track record of vulnerabilities, if everyone is under NDA and the company has no obligation to ever publicize it?

Now, if the reseacher could give a grace period, that's cool, but there MUST be a deadline by which stuff goes public. Hopefully the company fixes it and issues a postmortem first. If not - too bad!

Re: macOS High Sierra: Anyone can login as “root” with empty password

#624

Post by spoondan »

abritishguy wrote: post #534

Just in case it is relevant for anyone here this is what our security team have established thus far: - Can be mitigated by enabling the root user with a strong password - Can be detected with `osquery` using `SELECT * FROM plist WHERE path = "/private/var/db/dslocal/nodes/Default/users/root.plist" AND key = "passwd" AND length(value) > 1;";` - You can see what time the root account was enabled using `SELECT * FROM p…

You can also get the password last set time with:

    sudo dscl . -readpl "/Users/dan.koepke" accountPolicyData passwordLastSetTime

Re: macOS High Sierra: Anyone can login as “root” with empty password

#625

Post by kofejnik »

michaelbuckbee wrote: post #402
jackhack wrote: post #395

Earlier quoted context omitted.

I'm more concerned that the "exploit" works "after a few tries" and not the first-time-every-time, or not at all. One would think that something as simple as a login would be deterministic.

My understanding is that the first attempt is creating/enabling the root account with a blank password and that the subsequent login is actually utilizing it (which is kind of bizarre and probably why this was missed in testing).

it worked for me on 6th try or so. First few times, the prompt was returning to my user name, but then another failed attempt left it at 'root', and the next attempt succeeded

Re: macOS High Sierra: Anyone can login as “root” with empty password

#626

Post by jgowdy »

saagarjha wrote: post #499
Veen wrote: post #403

Earlier quoted context omitted.

Create a root password.

This isn't a fix, it's a hack. A computer with a root password is inherently more insecure than one without a root account at all.

Someone tell the Linux and UNIX users of the world that having a root account with a password is a "hack."

Re: macOS High Sierra: Anyone can login as “root” with empty password

#628

Post by madeofpalk »

kristofferR wrote: post #148
patcheudor wrote: post #32

Apple makes it pretty easy to report vulnerabilities to: product-security@apple.com They also respond to security@apple.com but prefer the product-security address. Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed. Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even…

I really disagree - this needs to be reported as much as possible publicly to create a huge thunderstorm of negative publicity for Apple. This isn't the first extremely serious and dumb High Sierra password bug this year [1] [2], and unless Apple is severely hurt by it, so they're forced to change, it won't be the last. High Sierra is full of bugs and seemingly not just annoying bugs, but also security bugs. Let's ho…

Do "responsbile disclosure" rules apply differently to Apple?

If so, why? How do you identify companies like Apple that get one set of rules to other companies?

Re: macOS High Sierra: Anyone can login as “root” with empty password

#629

Post by princekolt »

nathancahill wrote: post #600
OkGoDoIt wrote: post #575

Earlier quoted context omitted.

Seems to be something related to a backwards-compatibility code path for upgraded systems. According to multiple posts on this thread it only affects systems upgraded to High Sierra, not fresh installs. See https://news.ycombinator.com/item?id=15802622 for example. Adding extra layers for compatibility complicates testing and debugging. With this many eyes on it hopefully someone will be able to deduce exactly what's…

My High Sierra is a fresh install, and it's affected.

Yup. Can confirm. I installed it fresh on a VM from the downloaded installer and it is affected.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#630

Post by tomsmeding »

giancarlostoro wrote: post #580
michaelbuckbee wrote: post #402

Earlier quoted context omitted.

My understanding is that the first attempt is creating/enabling the root account with a blank password and that the subsequent login is actually utilizing it (which is kind of bizarre and probably why this was missed in testing).

The first time I tried it, it just worked. I'm certain I've used root before. On the GUI portion it works with no password, but on the terminal it does not let me login as root without a password. Some weird OS magic must be going on there?

AFAIK usually sudo doesn't let you enter an empty string as a password, even when the actual password is empty. So that is what you might be experiencing.
Post reply on HN