High Sierra has been one of the worst OSX upgrade.
macOS High Sierra: Anyone can login as “root” with empty password
721–730 of 1001 posts
Re: macOS High Sierra: Anyone can login as “root” with empty password
#722I was able to successfully fix this by using the
``` dsenableroot ```
utility; by first enabling the root user with a strong password, then disabling it with the
``` dsenableroot -d ```
option. It's heavily recommended to not leave the root user enabled.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#723[deleted]
Re: macOS High Sierra: Anyone can login as “root” with empty password
#724Amazingly, this was disclosed offhand on the Apple developer forums, two weeks ago (see final comment by chethan177): https://forums.developer.apple.com/thread/79235 (spotted by https://twitter.com/fristle/status/935670476214378496 )
"If you're able to log in (hurray, you're the admin now)"
Personally not very hurray
Re: macOS High Sierra: Anyone can login as “root” with empty password
#725Earlier quoted context omitted.
It's the neighborly thing to do, but people are under no obligation to report vulns privately. The blame lies squarely on Apple, not on the messenger. The fact that we know about it means we can take steps to mitigate the damage.
The blame lies squarely on Apple, not on the messenger. There is blame on both. If you leave your key in your front door lock and I blast out on twitter your address and tell people about it, I think I have some responsibility.
>If you leave your key in your front door lock and I blast out on twitter your address and tell people about it, I think I have some responsibility.
That's not a faithful analogy. Apple isn't your neighbour. They are the landlord. The scenario is more like that the landlord uses bogus locks in your complex, and you post it on twitter. You could complain to them privately too, but given your past experiences perhaps, you thought that twitter would be a more effective medium.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#726Earlier quoted context omitted.
> Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool no one is under any obligation to sweep company's security problems under the rug for them. If companies create incentives for people to share vulnerabilities with them first, great, but no one is under any obligation to participate in those programs. Don't ship broken software if you don't want pie in your face.
Forget the company. This harms users , who are not responsible for causing these issues; for all except the most technical 1% of Apple users, keeping the problem secret while Apple works on a quick patch is much more secure than telling the whole world immediately.
If it harms the company then they will take it more seriously and it will protect users more in future. If it doesn't harm the company then they have no incentive to change.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#727Wow. Can't believe it. It's true.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#728Earlier quoted context omitted.
The blame lies squarely on Apple, not on the messenger. There is blame on both. If you leave your key in your front door lock and I blast out on twitter your address and tell people about it, I think I have some responsibility.
If you sell locks and those locks can be opened by pulling on them twice, the reasonnable course of action is to make that fact known to every buyer ASAP, not tell you privately and wait for you to maybe issue a recall.
Locks don't nag you to decommission them quite as aggressively as OS X asks you to patch it. And an OS update was going to happen anyway, so including this patch doesn't really burden the user with an extra task they wouldn't already be subject to. Therefore, coordinated disclosure has a lot of value in the OS update ecosystem and very little in the physical lock ecosystem.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#729Earlier quoted context omitted.
Can you talk about how to correctly disable the root account if someone did try it?
If you're wondering how to disable it, the menu option can be found here: https://support.apple.com/en-gb/HT204012
According to another comment thread here https://news.ycombinator.com/item?id=15802113 disabling from the GUI re-enabled the bug.
On my laptop I was able to exploit the bug from the local GUI and then disable it from happening (as far as I can tell) by changing the root password from the shell with sudo passwd root and then disabling the root user altogether with dsenableroot -d
Re: macOS High Sierra: Anyone can login as “root” with empty password
#730Apple makes it pretty easy to report vulnerabilities to: product-security@apple.com They also respond to security@apple.com but prefer the product-security address. Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed. Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even…
I really disagree - this needs to be reported as much as possible publicly to create a huge thunderstorm of negative publicity for Apple. This isn't the first extremely serious and dumb High Sierra password bug this year [1] [2], and unless Apple is severely hurt by it, so they're forced to change, it won't be the last. High Sierra is full of bugs and seemingly not just annoying bugs, but also security bugs. Let's ho…
>Let's hope Apple gets sued for the damage
How can that happen in any case ? Isn't pretty much the first line in every license waiving of liability ? Unless you have some special contract with Apple that overrides other standard boxes that you ticked, how would anyone sue ?