Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

701–710 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#701

Post by AlexandrB »

openasocket wrote: post #651
kristofferR wrote: post #504

Earlier quoted context omitted.

The fact that you as the ordinary student can become root and create a lot of damage so easily is the only reason the public will care. Us geeks have been complaining about the horrible QA in macOS for years, yet nothing has been done. The fact that this is so simple to do will probably/hopefully get ordinary people to start talking about it too ("Hey, have you heard that you can hack Macs without a password? Very in…

It sounds to me like you're arguing that full disclosure in this situation could lead to a worse outcome for users in the short term, but the negative publicity will force Apple to improve their security posture, leading to a better outcome for users in the long term. (Please let me know if I'm miss-characterizing your argument) I think you have to be very careful about that line of argument. It's a single vulnerabil…

> I personally think the researcher should make the decision that best protects users from that specific vulnerability.

I find it odd that you're putting the responsibility of making decisions about how to protect Apple's users on an unaffiliated third party.

Apple has a multi-hundred-billion dollar war chest and, if they wanted to, could afford to make macOS the most secure operating system on the market. The fact that they don't is their own choice and a reflection of their priorities, not some act of God or a natural disaster. Putting the onus for cleaning up the mess in the most "responsible" way possible on third parties with a fraction of Apple's resources is being too kind to Apple.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#702

Post by nothrabannosir »

abritishguy wrote: post #534

Just in case it is relevant for anyone here this is what our security team have established thus far: - Can be mitigated by enabling the root user with a strong password - Can be detected with `osquery` using `SELECT * FROM plist WHERE path = "/private/var/db/dslocal/nodes/Default/users/root.plist" AND key = "passwd" AND length(value) > 1;";` - You can see what time the root account was enabled using `SELECT * FROM p…

Wait, isn't the point of having root you can erase your traces? Are these logs immutable, even to root? That sounds pretty next level.. and how do I trust the tools?

As far as I know, possibility of root = root = pwn, game over, time to format.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#703

Post by dailyvijeos »

Apple along with a decline in product utility, reliability and quality, their software has been getting buggier every year post-Jobs. The QA people should be fired and replaced with a team whom insists on perfection. Otherwise, these embarrassing incidents will repeat, errode their brand and encourage customers to seek other platforms.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#705

Post by deathanatos »

beedogs wrote: post #610
bradrydzewski wrote: post #379

Earlier quoted context omitted.

Responsible disclosure does not prevent negative publicity. It provides the vendor with a grace period during which they can fix the vulnerability. There can be plenty of negative publicity once the vulnerability is patched and publicly disclosed. Encouraging irresponsible disclosure because one wants to see Apple hurt is a reckless and selfish attitude because it puts millions of Apple customers at risk in the proce…

There is nothing irresponsible about disclosing huge vulnerabilities in software by any means necessary. Edit: as usual, downvotes but no response. I miss when this place was decent.

> as usual, downvotes but no response

The very comment you are replying do lists a reason why disclosing huge vulnerabilities without providing upstream time to patch is irresponsible: "because it puts millions of Apple customers at risk in the process."

Your comment doesn't refute the reasoning the comment you are replying to provides, and it also doesn't tell us anything about why you think "There is nothing irresponsible about disclosing huge vulnerabilities in software by any means necessary." You state your position, but offer no rationale, no reason for it; why should I accept your position as the correct or ethical thing to do?

Re: macOS High Sierra: Anyone can login as “root” with empty password

#706

Post by ridgeguy »

azernik wrote: post #692
na85 wrote: post #526

Earlier quoted context omitted.

This is one of the sillier things I've read today. The only way something like this slips through is a culture of complacency, or incompetence. And the only way Apple gets motivated to fix either of those two things is massive Pr damage.

How long have you been working in software? Bugs like this get past competent developers in reasonable organizations all the time . Human fallibility, yo.

Yeah, but...

It seems to me (somebody who has no chops in this domain) that this is such a basic bug. Like something a child would have found just messing around.

And it came from a corporation that has around $200B of cash and cash equivalents. Apple has the resources to test and find bugs like this.

That Apple didn't find it is down to leadership and priorities more than some inherent limits of producing reliable code. One spends on what one thinks important.

But who knows, I've got no domain expertise here. Maybe a fifth of a trillion dollars C&CE really isn't enough to fund production of more robust code. But really?

Re: macOS High Sierra: Anyone can login as “root” with empty password

#707

Post by philliphaydon »

No one else has mentioned it seems, digging through the twitter comments I found a tweet which states this was already known by Apple, and posted on the forums in the form of a solution...

https://forums.developer.apple.com/thread/79235#277225

Re: macOS High Sierra: Anyone can login as “root” with empty password

#708

Post by saas_co_de »

rched wrote: post #698
saas_co_de wrote: post #611

Earlier quoted context omitted.

> Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool no one is under any obligation to sweep company's security problems under the rug for them. If companies create incentives for people to share vulnerabilities with them first, great, but no one is under any obligation to participate in those programs. Don't ship broken software if you don't want pie in your face.

This isn’t about what’s best for Apple it’s about what is best for users. The way this was disclosed was bad for users.

In almost all cases immediate disclosure is better for end users who actually care about their security because they can take appropriate mitigation measures.

Just because the vulnerability is not disclosed does not mean it is not being actively exploited. It probably is.

Users who don't care about their security do not deserve to be "protected" at the expense of compromising the security of those who do care who benefit from immediate disclosure.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#709

Post by runesoerensen »

"Perhaps nobody noticed two weeks ago when the root login vulnerability in macOS High Sierra was shared as a helpful tip on Apple’s own Developer forums. https://forums.developer.apple.com/thread/79235 "

https://twitter.com/fristle/status/935670476214378496

Re: macOS High Sierra: Anyone can login as “root” with empty password

#710

Post by macNchz »

LeoPanthera wrote: post #142
patcheudor wrote: post #32

Apple makes it pretty easy to report vulnerabilities to: product-security@apple.com They also respond to security@apple.com but prefer the product-security address. Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed. Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even…

It's not local if you have Remote Desktop enabled. Works over that too. From there you can enable ssh and all bets are off.

The 'sign in as root with no password' method cannot be used to trigger the vulnerability initially via remote desktop. I tested it via SSH, File Sharing, Screen Sharing and Remote Management. None of these will enable the root user if it has not already been done locally.

Once the root user has been enabled locally, the only sharing settings I found to permit anyone remote access with the root/null combo is Remote Management.

Post reply on HN