Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

711–720 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#711

Post by azernik »

ridgeguy wrote: post #706
azernik wrote: post #692

Earlier quoted context omitted.

How long have you been working in software? Bugs like this get past competent developers in reasonable organizations all the time . Human fallibility, yo.

Yeah, but... It seems to me (somebody who has no chops in this domain) that this is such a basic bug. Like something a child would have found just messing around. And it came from a corporation that has around $200B of cash and cash equivalents. Apple has the resources to test and find bugs like this. That Apple didn't find it is down to leadership and priorities more than some inherent limits of producing reliable c…

This is kind of a weird corner case; OSX tries really hard to hide the UNIXiness of its system, including the special nature of the username "root". So I can easily someone not thinking to test it out super thoroughly

A lot of security vulnerabilities are of this type: "let's do crazy shit X that the system was not built for and see what breaks." I'm sure this will be in their test suite now though.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#713

Post by chj »

patcheudor wrote: post #32

Apple makes it pretty easy to report vulnerabilities to: product-security@apple.com They also respond to security@apple.com but prefer the product-security address. Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed. Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even…

In this particular case, I am grateful for the early disclosure that I can fix it right now instead of waiting. For a huge bomb like this, I think you really can't blame the messenger.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#714

Post by qiqitori »

patcheudor wrote: post #32

Apple makes it pretty easy to report vulnerabilities to: product-security@apple.com They also respond to security@apple.com but prefer the product-security address. Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed. Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even…

Since it isn't exactly easy to send emails securely, I think this piece of advice may need some more work.

The PGP key is available here: https://support.apple.com/en-us/HT201214

I wonder what percentage of emails to security@... (apple.com or otherwise) are sent encrypted...

Re: macOS High Sierra: Anyone can login as “root” with empty password

#715

Post by pls2halp »

dtf wrote: post #704

Amazingly, this was disclosed offhand on the Apple developer forums, two weeks ago (see final comment by chethan177): https://forums.developer.apple.com/thread/79235 (spotted by https://twitter.com/fristle/status/935670476214378496 )

That’s absolutely terrible. Does Apple not monitor those forums at all?

Re: macOS High Sierra: Anyone can login as “root” with empty password

#716

Post by jzl »

brianpgordon wrote: post #658
aquova wrote: post #484

Earlier quoted context omitted.

I think there's a middle ground to this. Submit your report to Apple security, allow them time to develop a patch, and then in a week go ahead and tweet at the big media outlets about it. I'm a die-hard Apple user myself, but I agree that the long list of severe bugs in High Sierra is absurd, and a big public backlash might be enough to kick them into gear. On the other hand, I, a university student with next to no u…

Maybe it's crazy that we give people physical access to machines and expect them not to be able to obtain root. I don't have any experience with enterprise-grade IT, but it seems like shared computers should be thin clients or at least use UEFI to securely boot an image over the network and not keep anything sensitive locally. If you give someone physical access to a box, they will be able to own it.

This is actually how the public workstations in MIT computer clusters have always worked. The root password is public to anyone with a legit account, but access to it gets you almost nothing because all services including the network filesystem are kerberized, and machines are really good at wiping all local changes upon logout. Some more details here: https://www.quora.com/Are-computer-networks-in-MIT-harder-to...

Re: macOS High Sierra: Anyone can login as “root” with empty password

#718

Post by ridgeguy »

azernik wrote: post #711
ridgeguy wrote: post #706

Earlier quoted context omitted.

Yeah, but... It seems to me (somebody who has no chops in this domain) that this is such a basic bug. Like something a child would have found just messing around. And it came from a corporation that has around $200B of cash and cash equivalents. Apple has the resources to test and find bugs like this. That Apple didn't find it is down to leadership and priorities more than some inherent limits of producing reliable c…

This is kind of a weird corner case; OSX tries really hard to hide the UNIXiness of its system, including the special nature of the username "root". So I can easily someone not thinking to test it out super thoroughly A lot of security vulnerabilities are of this type: "let's do crazy shit X that the system was not built for and see what breaks." I'm sure this will be in their test suite now though.

Thanks, appreciate your reply.

Maybe Apple should spin up a group of 7 - 14 year-olds to add to their test suite input. They might be better at coming up with crazy shit X that might break things.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#719

Post by patcheudor »

saagarjha wrote: post #495
bangonkeyboard wrote: post #164

Earlier quoted context omitted.

If you urgently want Apple to fix something, you do not file quiet bug reports. Apple only responds reliably to PR storms. This vulnerability is ridiculous, unacceptable, and braindead to execute.

You can go about it both ways: file a bug report, put a reasonable date that you want them to fix it by. Then you can disclose it.

This happens quite often. Report a bug to Apple through CERT as an example and they run with a well known 45 day disclosure timeline. For researchers who don't want to get into vendor conflicts this is a good path because CERT ultimately holds the decision.
Post reply on HN