Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

661–670 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#661

Post by [deleted] »

ybloviator wrote: post #660
princekolt wrote: post #650

Earlier quoted context omitted.

Bad news: I tried the exploit in my macOS Sierra installation and it didn't seem to work. However, the passwd entry on the output of your first command IS A LONE ASTERISK. However I still can't login as root. This leads me to believe this behavior has always been there, and maybe the login methods just didn't allow an empty password.

This is very normal in ' nix' systems. ' ' indicates a locked account. (I've given up figuring out how to escape an asterisk) ex: daemon:*:1:1::0:0:Owner of many system processes:/root:/usr/sbin/nologin operator:*:2:5::0:0:System &:/:/usr/sbin/nologin bin:*:3:7::0:0:Binaries Commands and Source:/:/usr/sbin/nologin tty:*:4:65533::0:0:Tty Sandbox:/:/usr/sbin/nologin If the OS is letting you in with a '*'in the encrypte…

[deleted]

Re: macOS High Sierra: Anyone can login as “root” with empty password

#662

Post by danjoc »

The person who found this is at greatest risk. Public disclosure keeps him safe.

"Oh, good boy. Thanks for the responsible disclosure. You're sure you haven't told ANYONE else about this? Great! Keep it that way and we'll send you a big check real soon. Promise!"

Coordinates acquired.

Boom.

Keep in mind, Apple was caught working directly with NSA in Snowden disclosures. The US government will drone strike people outside the US without trial or charges. Apple illegally SWATed a Gizmodo reporter over a leaked iPhone prototype.

I don't blame this Turkish national, not one bit.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#663

Post by milesokeefe »

thrusong wrote: post #496
milesokeefe wrote: post #481

Earlier quoted context omitted.

How many people are using the camera in pinned web apps? What's the app you use? I'd imagine most camera-related functions are already best served by native apps.

Does that make it OK? I mean, something as important to the web as getUserMedia is broken on websites only if you pin it to the home screen. Forcing people into Apple's walled garden doesn't seem like an acceptable excuse.

It's certainly not acceptable, I just think it hasn't been a priority for Apple since it's a relatively niche usecase.

It could also be a security/privacy decision to leave it broken but safe until they can implement camera access through WebViews securely.

The closest to any official reason I could find is a dev letting us know that mum's the word:

>I asked about this internally and the answer is that, right now, WebRTC is only supported in Safari. No WKWebView, not even SFSafariViewController.

https://forums.developer.apple.com/thread/88052#266901

Re: macOS High Sierra: Anyone can login as “root” with empty password

#664

Post by mygo »

milesokeefe wrote: post #657
mygo wrote: post #608

My computer automatically downloaded high sierra without me wanting it to. Whether I was tricked into clicking something I don’t know. And then I heard about the disk utility password bug and decided I should wait a while before installing this OS— it seems as though Apple wants me to do their QA for them. And now I hear about this. And I see that dumb ugly notch on the iPhone X (seriously who approved that design de…

Have you used an iPhone X? The notch actually makes a lot of sense once you've used the gestures associated with it, same with how it integrates into apps. I'll agree that they've made a lot of mistakes in their product lines recently but the iPhone X was not one of them. Well, sparing software. I've had intermittent phantom screen input using the latest betas on the X, making it infuriatingly unusable at times.

I get that you can swipe down from the left or the right. But obscuring a chunk of the screen is not something to aspire to. The notch is clearly a compromise to make room for hardware. They should have found a way to fit the hardware such that it doesn’t cutaway the screen.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#666

Post by azernik »

kristofferR wrote: post #429
bradrydzewski wrote: post #379

Earlier quoted context omitted.

Responsible disclosure does not prevent negative publicity. It provides the vendor with a grace period during which they can fix the vulnerability. There can be plenty of negative publicity once the vulnerability is patched and publicly disclosed. Encouraging irresponsible disclosure because one wants to see Apple hurt is a reckless and selfish attitude because it puts millions of Apple customers at risk in the proce…

Closed disclosure does, to a large degree, prevent negative publicity. I don't think it is in dispute that this bug would receive vastly less media coverage if it were only revealed as a bug in outdated/patched versions of the OS. I don't want to see Apple hurt (I'm an Apple-guy myself, using Macs, iPhone, iPad and Apple Watch), I want to see them improve. I doubt they start will start caring about QA unless they're…

Giving Apple negative publicity is not an end that justifies harming its users.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#670

Post by sooheon »

tn_ wrote: post #366
pcwalton wrote: post #135

Earlier quoted context omitted.

The problem with that analogy is that the probability that the "bad guys" already know about this vulnerability is vastly higher than the probability that thieves know about how well some random house in the neighborhood is secured.

How many more people now know about this vulnerability cause of this knuckle-head tweeting it? At least 100k impressions? Now think of how many more "bad guys" have access to this hack that are going to abuse it.

And how many people and companies are now empowered to fix this issue for themselves, immediately.
Post reply on HN