Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

641–650 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#641

Post by ztjio »

tekacs wrote: post #387
Jedd wrote: post #239

Earlier quoted context omitted.

Not the case. Once you enable root access - by 'testing' this - others can remotely & silently access the system as root. GP is right - don't encourage people to test this, as there's nothing to gain from it. If you're on a shared machine you need to mitigate. If you're on your own dedicated machine you need to not share it until this is fixed.

Even if you're on a dedicated machine, this vulnerability enables a local user to bypass the authentication prompt on things like System Preferences or other auth checks. I'm advising folks (incl. non-tech) to set a root password and then re-disable the account (specifically via shell), which prevents this from re-occuring: https://www.facebook.com/amar.sood/posts/10209545863036116

Uh I tested redisabling the root account and it reenabled the flaw. You have to keep the root account enabled.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#642

Post by bambax »

e40 wrote: post #102
sillysaurus3 wrote: post #87

Earlier quoted context omitted.

It's the neighborly thing to do, but people are under no obligation to report vulns privately. The blame lies squarely on Apple, not on the messenger. The fact that we know about it means we can take steps to mitigate the damage.

The blame lies squarely on Apple, not on the messenger. There is blame on both. If you leave your key in your front door lock and I blast out on twitter your address and tell people about it, I think I have some responsibility.

If you sell locks and those locks can be opened by pulling on them twice, the reasonnable course of action is to make that fact known to every buyer ASAP, not tell you privately and wait for you to maybe issue a recall.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#643

Post by hateduser2 »

5ilv3r wrote: post #565
legohead wrote: post #301

Earlier quoted context omitted.

I wouldn't bash the guy. Someone already let him know about his technical faux pas in a professional manner on his twitter. My guess is he found this vulnerability on accident, freaked out, and tweeted about it. Probably has limited infosec experience.

Or he cares more about doing the right thing than about following best practices designed to protect the guilty under the guise of helping users.

Idk why u say “designed to protect the guilty under the guise of protecting the innocent”.. it clearly does both. It does protect the innocent. That is a fact! It also does protect the guilty! Both are true. It makes it harder to have a strong view when you must acknowledge both facts I suppose

Re: macOS High Sierra: Anyone can login as “root” with empty password

#644

Post by ztjio »

biktor_gj wrote: post #371
Jedd wrote: post #239

Earlier quoted context omitted.

Not the case. Once you enable root access - by 'testing' this - others can remotely & silently access the system as root. GP is right - don't encourage people to test this, as there's nothing to gain from it. If you're on a shared machine you need to mitigate. If you're on your own dedicated machine you need to not share it until this is fixed.

No, root is root and has always been there. It's the super user account and cannot be removed, I think, from any modern unix like os (well, you can rename it to whatever you want in linux but UID 0 will always be there). The difference might be that if you do log in for the first time you will have lots of stuff on /private/var/root (talking from memory but it was something like that in OSX) and lots of preferences w…

Root can absolutely be disabled. OS X normally runs rootless. This vulnerability actually both gives access AND enables that disabled root account in one action. From that point on, root is active with no password regardless of how you authenticate whereas the initial issue is only on password GUI screens.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#645

Post by dsmithatx »

ig1 wrote: post #503
ben_w wrote: post #478

Earlier quoted context omitted.

> admittedly low priority security vuln, passwords being sent over http Wait, what ?

Unfortunately it's still more common than you think. The other day I actually ran across some AWS docs which suggest you send your AWS root key id in the url of http requests: http://docs.aws.amazon.com/AlexaWebInfoService/latest/index....

Wow I didn't believe this at first, so I dug more. AWIS requires the root key of an AWS account. I found a forum that does suggest creating a new account solely for AWIS.

https://forums.aws.amazon.com/thread.jspa?threadID=126537

Still I'm surprised they would suggest sending the root key to your account over http. Even if it is just the id and not secret it still seems like something you want to keep secure. I don't use my root key for services. I create new accounts and IAM roles.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#646

Post by tekacs »

ztjio wrote: post #641
tekacs wrote: post #387

Earlier quoted context omitted.

Even if you're on a dedicated machine, this vulnerability enables a local user to bypass the authentication prompt on things like System Preferences or other auth checks. I'm advising folks (incl. non-tech) to set a root password and then re-disable the account (specifically via shell), which prevents this from re-occuring: https://www.facebook.com/amar.sood/posts/10209545863036116

Uh I tested redisabling the root account and it reenabled the flaw. You have to keep the root account enabled.

See https://news.ycombinator.com/item?id=15802113

Re: macOS High Sierra: Anyone can login as “root” with empty password

#647

Post by thetruthseeker1 »

kristofferR wrote: post #429
bradrydzewski wrote: post #379

Earlier quoted context omitted.

Responsible disclosure does not prevent negative publicity. It provides the vendor with a grace period during which they can fix the vulnerability. There can be plenty of negative publicity once the vulnerability is patched and publicly disclosed. Encouraging irresponsible disclosure because one wants to see Apple hurt is a reckless and selfish attitude because it puts millions of Apple customers at risk in the proce…

Closed disclosure does, to a large degree, prevent negative publicity. I don't think it is in dispute that this bug would receive vastly less media coverage if it were only revealed as a bug in outdated/patched versions of the OS. I don't want to see Apple hurt (I'm an Apple-guy myself, using Macs, iPhone, iPad and Apple Watch), I want to see them improve. I doubt they start will start caring about QA unless they're…

Closed disclosure is responsible disclosure. Moving past the terminology, I am an Apple user as well, I am pretty satisfied with how quickly Apple resolves issues.

Now if every person started disclosing vulnerabilities via twitter without giving the company turn around time to resolve the issue based on their dissatisfaction with Apple based on standards they came up with personally, I don’t think it is nice or fair.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#648

Post by IBM »

2trill2spill wrote: post #599
IBM wrote: post #583

Earlier quoted context omitted.

It's common among a small group of Mac users to hold Snow Leopard up as the peak of software quality, but only because of rose-colored glasses [1]. [1] https://www.computerworld.com/article/2528936/mac-os-x/snow-...

I should have specified I meant 10.6.8 I ran it on my main computer until 10.9.2 because of the problems I had experienced with Lion and Mountain Lion on other computers. Also I think when most people think of Snow Leopard they're thinking of 10.6.8, at least that's the version number you always see get thrown around on the internet.

The last High Sierra update will have less bugs than the next major release too, so I don't think that's really relevant.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#649

Post by briandear »

bangonkeyboard wrote: post #596
patcheudor wrote: post #509

Earlier quoted context omitted.

> Apple only responds reliably to PR storms They've been quick (within 45 days) to patch every major bug I've reported to them and where the bugs were cross platform, impacting Windows, Android, etc., they've consistently been amongst the quickest to issue a patch so I'm not sure how you qualify that statement.

I qualified it with "reliably". Major bugs reported by you, a security researcher, may be bucketed differently than those deemed less serious or filed by others. As a recent example, a minor bug like the iOS 11 calculator ignoring keypresses had reports filed since Beta 1, but only after it made headlines and caused Apple public embarrassment will it be addressed in the upcoming 11.2, six months later.

A calculator bug is hardly in the same ballpark.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#650

Post by princekolt »

RJIb8RBYxzAMX9u wrote: post #614
abritishguy wrote: post #534

Just in case it is relevant for anyone here this is what our security team have established thus far: - Can be mitigated by enabling the root user with a strong password - Can be detected with `osquery` using `SELECT * FROM plist WHERE path = "/private/var/db/dslocal/nodes/Default/users/root.plist" AND key = "passwd" AND length(value) > 1;";` - You can see what time the root account was enabled using `SELECT * FROM p…

osquery is not a built-in tool. You can get the same info with plutil(1): $ sudo plutil -p /private/var/db/dslocal/nodes/Default/users/root.plist If I understand OP correctly, if passwd is a lone asterisk, then you haven't been exploited. Edit: trying a little harder to dump accountPolicyData: $ sudo defaults read /private/var/db/dslocal/nodes/Default/users/root.plist accountPolicyData | grep -oE '[[:xdigit:]]+' | xx…

Bad news: I tried the exploit in my macOS Sierra installation and it didn't seem to work. However, the passwd entry on the output of your first command IS A LONE ASTERISK.

However I still can't login as root. This leads me to believe this behavior has always been there, and maybe the login methods just didn't allow an empty password.

Post reply on HN