Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

71–80 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#71

Post by jameskilton »

martinp wrote: post #59
jcoby wrote: post #38

Be careful testing this! It appears that you're creating a "root" superuser with no password. Be sure to clean up that user afterwords. https://twitter.com/a_hailes/status/935601901839806464

This support article explains how to disable the root user: https://support.apple.com/en-us/HT204012

Do note that this doesn't fix the problem. The system (at least High Sierra) will happily re-enable the user for every attempt at logging in.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#72

Post by michaelmcmillan »

ky738 wrote: post #51
michaelmcmillan wrote: post #21

Are we really ready for self-driving cars? https://www.youtube.com/watch?v=4G1Boh-URIM

I will take malicious improper analogy for 100

Please point out the discrepancy.

A Tesla has ~ 100.000.000 [1] lines of code. Considering this post, do you think we are sufficiently educated in software security to produce secure self-driving cars?

Elon Musk: "I think one of the biggest risks for autonomous vehicles is somebody achieving a fleet wide hack" [2].

[1] https://bit.ly/KIB_linescode

[2] https://www.youtube.com/watch?v=4G1Boh-URIM

Re: macOS High Sierra: Anyone can login as “root” with empty password

#73

Post by psychometry »

jcoby wrote: post #38

Be careful testing this! It appears that you're creating a "root" superuser with no password. Be sure to clean up that user afterwords. https://twitter.com/a_hailes/status/935601901839806464

You're not creating it, but rather enabling it. When the bug is triggered, the root user is enabled (per Directory Utility).

Re: macOS High Sierra: Anyone can login as “root” with empty password

#74

Post by anon1253 »

cortesoft wrote: post #61
anon1253 wrote: post #24

wat. confirmed on 10.13.1 (17B48). I was even able to add another super user. Edit: changing the login method to "Name and password" under login options, then logout and login with "root" with empty password also works. Fortunately, it doesn't work on cold boot with FileVault enabled, at least it doesn't appear so. `sudo su root` also doesn't work with an empty password.

well, `sudo su root` would be using the user password for the logged in user, not for root. Does `su root` work, with no password at the prompt?

Good point. Force of habit. Unfortunately I can no longer try since I set the root password under the Directory Utility, which probably changed the state of the system.

Apparently someone verified that it /does/ also work with `su - root`.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#79

Post by khana »

patcheudor wrote: post #32

Apple makes it pretty easy to report vulnerabilities to: product-security@apple.com They also respond to security@apple.com but prefer the product-security address. Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed. Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even…

the only thing not-cool is this egregious short-coming from Apl
Post reply on HN