macOS High Sierra: Anyone can login as “root” with empty password

Post by divbzero » Wed, Nov 29, 2017, 5:15 AM UTC

abritishguy wrote: post #534

Just in case it is relevant for anyone here this is what our security team have established thus far: - Can be mitigated by enabling the root user with a strong password - Can be detected with `osquery` using `SELECT * FROM plist WHERE path = "/private/var/db/dslocal/nodes/Default/users/root.plist" AND key = "passwd" AND length(value) > 1;";` - You can see what time the root account was enabled using `SELECT * FROM p…

Post by 3131s » Wed, Nov 29, 2017, 5:22 AM UTC

alpb wrote: post #522

[meta] I think this thread is currently being downvoted, or dragged down by the mods somehow. It should be in the #1 right now. I suspect people are flagging/downvoting because there is no responsible disclosure in this case.

Post by timsutton » Wed, Nov 29, 2017, 5:47 AM UTC

RJIb8RBYxzAMX9u wrote: post #614

abritishguy wrote: post #534

Just in case it is relevant for anyone here this is what our security team have established thus far: - Can be mitigated by enabling the root user with a strong password - Can be detected with `osquery` using `SELECT * FROM plist WHERE path = "/private/var/db/dslocal/nodes/Default/users/root.plist" AND key = "passwd" AND length(value) > 1;";` - You can see what time the root account was enabled using `SELECT * FROM p…

osquery is not a built-in tool. You can get the same info with plutil(1): $ sudo plutil -p /private/var/db/dslocal/nodes/Default/users/root.plist If I understand OP correctly, if passwd is a lone asterisk, then you haven't been exploited. Edit: trying a little harder to dump accountPolicyData: $ sudo defaults read /private/var/db/dslocal/nodes/Default/users/root.plist accountPolicyData | grep -oE '[[:xdigit:]]+' | xx…

Post by [deleted] » Wed, Nov 29, 2017, 5:50 AM UTC

neotek wrote: post #738

pls2halp wrote: post #715

Earlier quoted context omitted.

That’s absolutely terrible. Does Apple not monitor those forums at all?

Apple's support forums aren't a place where Apple provides their users with support, they're where Apple users seek support from other Apple users, mostly unhelpful and often inaccurate support. In fact, 99% of the time the only advice you'll get is "restore your iPhone", "restore your MacBook Pro", "restore your Apple TV" and so on into bitter infinity.

Post by biktor_gj » Wed, Nov 29, 2017, 5:54 AM UTC

ztjio wrote: post #644

biktor_gj wrote: post #371

Earlier quoted context omitted.

No, root is root and has always been there. It's the super user account and cannot be removed, I think, from any modern unix like os (well, you can rename it to whatever you want in linux but UID 0 will always be there). The difference might be that if you do log in for the first time you will have lots of stuff on /private/var/root (talking from memory but it was something like that in OSX) and lots of preferences w…

Root can absolutely be disabled. OS X normally runs rootless. This vulnerability actually both gives access AND enables that disabled root account in one action. From that point on, root is active with no password regardless of how you authenticate whereas the initial issue is only on password GUI screens.