Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

771–780 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#771

Post by vsl »

warent wrote: post #755
ybloviator wrote: post #660

Earlier quoted context omitted.

This is very normal in ' nix' systems. ' ' indicates a locked account. (I've given up figuring out how to escape an asterisk) ex: daemon:*:1:1::0:0:Owner of many system processes:/root:/usr/sbin/nologin operator:*:2:5::0:0:System &:/:/usr/sbin/nologin bin:*:3:7::0:0:Binaries Commands and Source:/:/usr/sbin/nologin tty:*:4:65533::0:0:Tty Sandbox:/:/usr/sbin/nologin If the OS is letting you in with a '*'in the encrypte…

I'm confused, why do you have to escape an asterisk?

Markdown in HN comments.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#772

Post by [deleted] »

ukblewis wrote: post #486
kristofferR wrote: post #429

Earlier quoted context omitted.

Closed disclosure does, to a large degree, prevent negative publicity. I don't think it is in dispute that this bug would receive vastly less media coverage if it were only revealed as a bug in outdated/patched versions of the OS. I don't want to see Apple hurt (I'm an Apple-guy myself, using Macs, iPhone, iPad and Apple Watch), I want to see them improve. I doubt they start will start caring about QA unless they're…

I actually do think it is in dispute. This is a tweet after all. This guy could totally tweet about it in much the same way after Apple released a patch. The negative publicity would still exist because the bug would be equally stupid and disastrous, just fewer people would be harmed along the way.

[deleted]

Re: macOS High Sierra: Anyone can login as “root” with empty password

#775

Post by moogly »

LeoPanthera wrote: post #465
gaius wrote: post #132

But someone at Apple got their bonus for shipping the animated poop icon in time for this release.

If you think the team that makes animojis is the same team in charge of security or QA, I have news for you.

At this point, I'm not so sure.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#776

Post by thedarkproject »

patcheudor wrote: post #32

Apple makes it pretty easy to report vulnerabilities to: product-security@apple.com They also respond to security@apple.com but prefer the product-security address. Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed. Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even…

Security by Obscurity never works.

Source: Information Security 101

Re: macOS High Sierra: Anyone can login as “root” with empty password

#777

Post by marctrem »

labcomputer wrote: post #731
nothrabannosir wrote: post #702

Earlier quoted context omitted.

Wait, isn't the point of having root you can erase your traces? Are these logs immutable, even to root? That sounds pretty next level.. and how do I trust the tools? As far as I know, possibility of root = root = pwn, game over, time to format.

System Integrity Protection (SIP)[1] does prevent even the root user from modifying some system files[2]. It seems possible, at least in principle, to protect system logs from modification by user root. In practice, I think most system logs are stored in /var, and that part of the directory tree does not appear to be protected by SIP (but I hope I'm wrong!) [1] https://support.apple.com/en-us/HT204899 [2] Unless/unti…

A motivated and knowledgeable adversary could most likely load a custom kext to bypass the integrity measures. Am I right?

Re: macOS High Sierra: Anyone can login as “root” with empty password

#778

Post by nothrabannosir »

marctrem wrote: post #777
labcomputer wrote: post #731

Earlier quoted context omitted.

System Integrity Protection (SIP)[1] does prevent even the root user from modifying some system files[2]. It seems possible, at least in principle, to protect system logs from modification by user root. In practice, I think most system logs are stored in /var, and that part of the directory tree does not appear to be protected by SIP (but I hope I'm wrong!) [1] https://support.apple.com/en-us/HT204899 [2] Unless/unti…

A motivated and knowledgeable adversary could most likely load a custom kext to bypass the integrity measures. Am I right?

You can't load unsigned kexts anymore, due to that same SIP. It's a pain in the gonads when hacking your own kexts. I had forgotten about this, but it does indeed allow for a system that leaves an audit trail which cannot be hidden, even by root.

However, user labcomputer is right, I doubt that applies to the solutions proposed by OP here. Well, I'm certain: root can switch out the shell or terminal emulator binary itself and have it lie about executing those commands and return something trustworthy. One way or another, to truly check this, you'd need an immutable audit log (probably not currently available), AND a reboot into safe mode or a mount as a HDD onto a safe system.

Post reply on HN