Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

631–640 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#631

Post by 5ilv3r »

hw wrote: post #443
kristofferR wrote: post #148

Earlier quoted context omitted.

I really disagree - this needs to be reported as much as possible publicly to create a huge thunderstorm of negative publicity for Apple. This isn't the first extremely serious and dumb High Sierra password bug this year [1] [2], and unless Apple is severely hurt by it, so they're forced to change, it won't be the last. High Sierra is full of bugs and seemingly not just annoying bugs, but also security bugs. Let's ho…

Why does it need to create a lot of negative publicity for Apple? Is there something you don't like about them? Responsible disclosure needs to be valued given the number of macs out there in the wild that could potentially be susceptible to issues like this, and the impact it could have on people (including you) not just directly but indirectly. How would you feel if someone discovered a 0day at a company that expos…

The problem is that this is not a zero day in new technology. They made a jr sysadmin mistake. As a company who wants a reputation for good security, that is not acceptable.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#633

Post by eridius »

mostlyskeptical wrote: post #612
eridius wrote: post #451

Earlier quoted context omitted.

> Safari couldn't even render apples website correctly. Nor could Safari connect to any site with HTTPS. Sounds like something's wrong with your friend's computer, because neither of those issues are reasonable to expect no matter what your opinion of Apple's software is. > But the submit button on their developer site is broken Given the number of people who've successfully gone through that form, I'm willing to bet…

>neither of those issues are reasonable to expect no matter what your opinion of Apple's software is. Neither is your password showing up in a password hint field (or anywhere for that matter... why is it even stored unhashed?). Neither is logging in with a blank password enabling a disabled root user.

> Neither is your password showing up in a password hint field (or anywhere for that matter... why is it even stored unhashed?).

It's not stored unhashed. And the password hint field never showed the password, it always showed the password hint.

The bug was Disk Utility's UI was accidentally using the password field instead of the password hint field when passing the data to the underlying API.

> Neither is logging in with a blank password enabling a disabled root user.

Stupid and awful bug, sure, but I actually can understand it. Something that's worked fine for years breaks because of some change to some underlying system, and there weren't any existing tests to see what happens if you try and log in as root (root has been disabled by default for something like 15 years, so it doesn't surprise me that people don't test trying to log in with it).

But apple.com not rendering right in Safari? That doesn't make sense, you know damn well apple.com is basically designed to be viewed in Safari and everybody that works on it is going to be using Safari with it.

And Safari not being able to load HTTPS sites makes even less sense. That literally breaks most of the web. This has to be an issue with the local computer.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#634

Post by jldugger »

jldugger wrote: post #282
stingraycharles wrote: post #243

Earlier quoted context omitted.

The issue is that the bug leaves a password-less root account available through other means as well. Once you try to reproduce the bug, an attacker could potentially do a remote root login without password. As such, it's very dangerous for people to try to verify and should be strongly discouraged.

On most systems, root without password isn't available remotely. Is this not true on OSX?

Apparently, High Sierra has a 'feature' that updates hashes to a new format on login, and consequently publishes a hash where there was none before. Which pretty much disables the 'no hash, no login' policies. Ooops. Donno if that's unique to the GUI, or if a simple 'sudo su -' would also trigger, as I don't own a mac.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#635

Post by hateduser2 »

ryanmarsh wrote: post #606
llamataboot wrote: post #516

That twitter thread and lots of the comments are missing the point. MANY people don't know about what the ethics of reporting vulnerabilities are, they just want to say something and get it fixed. yes, it probably would have been better if this person had gone through proper channels, but there's no evidence they did it for the lulz/fame. In this case the bug is so bad and egregious, that publicizing it with the fix…

I’m not a security researcher and I don’t work for Apple. If I casually came across this I would totally tweet it out. Anyone asserting I should follow some sort of procedure has a misplaced sense of reality.

You would do that.. but you don’t consider what you should do.. surely responsible disclosure is the smarter strategy?

Re: macOS High Sierra: Anyone can login as “root” with empty password

#636

Post by 2trill2spill »

eridius wrote: post #589
2trill2spill wrote: post #547

Earlier quoted context omitted.

> Sounds like something's wrong with your friend's computer, because neither of those issues are reasonable to expect no matter what your opinion of Apple's software is. Doubtful Firefox and Chrome work just fine. > Given the number of people who've successfully gone through that form, I'm willing to bet it's a content blocker extension that's blocking some dependency the form needs. Brand new install of Mac OS on a…

> Doubtful Firefox and Chrome work just fine. That doesn't mean anything. It just means that whatever is messed up affects Safari. It's not like the computer recognizes "oh those 3 apps are all web browsers, therefore if I'm going to screw one of them up, I have to screw them all up". Your claim would carry more weight if you were listing multiple browsers that all use the same system-provided WebKit.framework, but F…

> That doesn't mean anything. It just means that whatever is messed up affects Safari. It's not like the computer recognizes "oh those 3 apps are all web browsers, therefore if I'm going to screw one of them up, I have to screw them all up". Your claim would carry more weight if you were listing multiple browsers that all use the same system-provided WebKit.framework, but Firefox and Chrome are completely separate browsing engines.

That fact that everything besides Safari works certainly means something and the fact that they have different rendering engines is irrelevant. What is relevant is whether a site renders in a browser or not.

> Well I don't know what to tell you, except to point out that there's, what, hundreds of thousands of registered Apple developers now? who've all had to go through that form, and there's only a handful of people on that thread, so it's far more likely to be a local issue.

Well that's just one example of dozens of people having that problem. Also I have successfully filled out that form my self in the past, as I am a registered apple developer. But just because large amounts of people can use the form successfully does not mean that there isn't a bug affecting other user's like my friend.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#637

Post by princekolt »

zach43 wrote: post #422
raydev wrote: post #300

I've been a developer for a long time. I understand bugs happen, even bugs with terrible consequences. A lot of bugs seem understandable, like I can see the chain of ifs/thens required to end up at some hilarious broken state. But I'm breaking my brain trying to figure out how in the hell a login attempt for "root" will enable it if it's disabled. Why is this is a possibility, to just enable root, no questions asked?

Maybe something like this was added to make debugging/testing of the OS easier? maybe they just forgot to remove it before shipping the new macOS

That seems the only probable cause I've come across so far. It doesn't seem to be a backdoor because it would be more of a back-spillway-gate.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#638

Post by hateduser2 »

zokier wrote: post #253
jeffisabelle wrote: post #154

I still can't believe more people complain about this being publicly disclosed than this being possible in the first place. No one is obligated to know the procedures on InfoSec 0-days and follow those steps.

Most likely another from of bikeshedding; people don't have real input on the main matter, so they comment on circumstantial matters just so they can throw in their 2c

Or they have real circumstantial comments to make.. it doesn’t have to be that they just want to talk

Re: macOS High Sierra: Anyone can login as “root” with empty password

#639

Post by bambax »

hw wrote: post #443
kristofferR wrote: post #148

Earlier quoted context omitted.

I really disagree - this needs to be reported as much as possible publicly to create a huge thunderstorm of negative publicity for Apple. This isn't the first extremely serious and dumb High Sierra password bug this year [1] [2], and unless Apple is severely hurt by it, so they're forced to change, it won't be the last. High Sierra is full of bugs and seemingly not just annoying bugs, but also security bugs. Let's ho…

Why does it need to create a lot of negative publicity for Apple? Is there something you don't like about them? Responsible disclosure needs to be valued given the number of macs out there in the wild that could potentially be susceptible to issues like this, and the impact it could have on people (including you) not just directly but indirectly. How would you feel if someone discovered a 0day at a company that expos…

> Is there something you don't like about them?

You mean, in addition to bad QA and complete disregard for their users' security? And being the richest and most profitable company ever, cutting corners and evading taxes?

Their response on Twitter was amazing: "PM us so we can discuss this privately", not "thank you, we're looking into it NOW".

Re: macOS High Sierra: Anyone can login as “root” with empty password

#640

Post by j-pb »

Oh god, seriously what happened to apple? They are the richest company in the world and the quality of their software has kept declining every year. Right now there is no computer system that I can wholeheartedly recommend to non technical people... :(
Post reply on HN