Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

731–740 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#731

Post by labcomputer »

nothrabannosir wrote: post #702
abritishguy wrote: post #534

Just in case it is relevant for anyone here this is what our security team have established thus far: - Can be mitigated by enabling the root user with a strong password - Can be detected with `osquery` using `SELECT * FROM plist WHERE path = "/private/var/db/dslocal/nodes/Default/users/root.plist" AND key = "passwd" AND length(value) > 1;";` - You can see what time the root account was enabled using `SELECT * FROM p…

Wait, isn't the point of having root you can erase your traces? Are these logs immutable, even to root? That sounds pretty next level.. and how do I trust the tools? As far as I know, possibility of root = root = pwn, game over, time to format.

System Integrity Protection (SIP)[1] does prevent even the root user from modifying some system files[2]. It seems possible, at least in principle, to protect system logs from modification by user root. In practice, I think most system logs are stored in /var, and that part of the directory tree does not appear to be protected by SIP (but I hope I'm wrong!)

[1] https://support.apple.com/en-us/HT204899

[2] Unless/until you reboot to a diagnostic monitor on a special partition (which requires pressing command-R from a local keyboard during the POST), then run a command to disable SIP, and then reboot again. Continuity Activation Tool requires users to perform this step as part of the install process to allow installation of Bluetooth drivers not originally signed by Apple.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#732

Post by the_economist »

dwighttk wrote: post #105

I mean, I only tried 15 times, I don't know if that counts as "several" but this doesn't work for me. It looks to me like my root user is disabled. When I type "root" into the username field and click unlock (in System Preferences > Users & Groups) "root" is replaced with my username and the dialog shakes... I have to type root in each time, but it never unlocks. 10.13.1 Edit: trying it after logging out keeps "root"…

I was just able to reproduce it in 10.13.1. I had to click submit twice.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#733

Post by flukus »

azernik wrote: post #692
na85 wrote: post #526

Earlier quoted context omitted.

This is one of the sillier things I've read today. The only way something like this slips through is a culture of complacency, or incompetence. And the only way Apple gets motivated to fix either of those two things is massive Pr damage.

How long have you been working in software? Bugs like this get past competent developers in reasonable organizations all the time . Human fallibility, yo.

After the developers there is a line of QA as well, but part of the problem is having the organisational structures for developers to discover issues like this. Regular audits, security as a priority and non-recrimination policies would be a good start. In many companies if you bring up problems like this then your "not a team player", in others you could point out issues like this all day long but they will never be acted upon because the budget isn't there for various reasons.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#734

Post by pwdisswordfish2 »

If someone has physical access to the Apple computer in order to "log in", then even if the owner has set a strong root password, what stops anyone from rebooting, holding down Command+S and booting into single user mode?

In single user mode, as all macOS users know, there will be no access limits. Anything can be changed.

How are users preventing from rebooting into single user mode?

Re: macOS High Sierra: Anyone can login as “root” with empty password

#736

Post by hunter2_ »

macNchz wrote: post #710
LeoPanthera wrote: post #142

Earlier quoted context omitted.

It's not local if you have Remote Desktop enabled. Works over that too. From there you can enable ssh and all bets are off.

The 'sign in as root with no password' method cannot be used to trigger the vulnerability initially via remote desktop. I tested it via SSH, File Sharing, Screen Sharing and Remote Management. None of these will enable the root user if it has not already been done locally. Once the root user has been enabled locally, the only sharing settings I found to permit anyone remote access with the root/null combo is Remote M…

I don't think they meant using this vulnerability to enable a root remote connection, but using an existing non-root remote connection (think TeamViewer, VNC, whatever) and escalating.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#737

Post by hunter2_ »

dhimes wrote: post #198
patcheudor wrote: post #32

Apple makes it pretty easy to report vulnerabilities to: product-security@apple.com They also respond to security@apple.com but prefer the product-security address. Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed. Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even…

Is this address easily discoverable without needing too much insight into tech company workings? Like, do they have a help menu that tells people where to report stuff? I'm not an apple user.

https://www.google.com/search?q=apple+report+security+bug does bring https://support.apple.com/en-us/HT201220 right up, but that page documents "how security researchers, developers, law enforcement personnel, and journalists can contact Apple to report or ask about a security issue" -- notably absent from that set is "your average Joe who stumbled upon something entirely by accident" for some reason.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#738

Post by neotek »

pls2halp wrote: post #715
dtf wrote: post #704

Amazingly, this was disclosed offhand on the Apple developer forums, two weeks ago (see final comment by chethan177): https://forums.developer.apple.com/thread/79235 (spotted by https://twitter.com/fristle/status/935670476214378496 )

That’s absolutely terrible. Does Apple not monitor those forums at all?

Apple's support forums aren't a place where Apple provides their users with support, they're where Apple users seek support from other Apple users, mostly unhelpful and often inaccurate support.

In fact, 99% of the time the only advice you'll get is "restore your iPhone", "restore your MacBook Pro", "restore your Apple TV" and so on into bitter infinity.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#739

Post by heartbreak »

oneeyedpigeon wrote: post #258
patcheudor wrote: post #32

Apple makes it pretty easy to report vulnerabilities to: product-security@apple.com They also respond to security@apple.com but prefer the product-security address. Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed. Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even…

Let's wait until Apple release their patch so we know just how long they left everyone's machines vulnerable for. That will be a factor in determining whether this disclosure was irresponsible or not. It's been two and a half hours so far.

If Apple released a patch in less than 24 hours I’d be seriously concerned about the QA that had gone into the patch.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#740

Post by jodrellblank »

patcheudor wrote: post #32

Apple makes it pretty easy to report vulnerabilities to: product-security@apple.com They also respond to security@apple.com but prefer the product-security address. Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed. Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even…

Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even if it is local: think of the impact to shared iMacs on university campuses.

How dare you publicly shame him and risk his future employability like this? It's only responsible of you to contact him quietly and directly so he can correct his mistake and cover it up so nobody needs to know.

It's like there's one rule for the negligent global corporation which happens to work in the corporation's favor and shames the public for speaking to each other about their salary, I mean flaws in their software, and another rule for ordinary people giving a heads up to people who are fair game to pile on.

Post reply on HN