LOL. Can we call this...front door?
macOS High Sierra: Anyone can login as “root” with empty password
781–790 of 1001 posts
Re: macOS High Sierra: Anyone can login as “root” with empty password
#782Earlier quoted context omitted.
Responsible disclosure does not prevent negative publicity. It provides the vendor with a grace period during which they can fix the vulnerability. There can be plenty of negative publicity once the vulnerability is patched and publicly disclosed. Encouraging irresponsible disclosure because one wants to see Apple hurt is a reckless and selfish attitude because it puts millions of Apple customers at risk in the proce…
A bug like 'can log in with password "root"/""' just isn't going to get you a grace period no matter what security researchers might want. I mean, this bugs has been reported already - by every cheesy hacking movie ever, by every beginners book on social engineering and so-forth. Heck, it was "reported" by Richard Feynman talking about cracking safes during the Manhattan.
Pretty sure every cheesy hacker film doesn't have the root password being empty. They usually put in "password" or the favourite music band of the target.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#783[meta] I think this thread is currently being downvoted, or dragged down by the mods somehow. It should be in the #1 right now. I suspect people are flagging/downvoting because there is no responsible disclosure in this case.
Not the first time I've noticed this with threads that are bad PR for Apple.
Be careful about noticing a few data points and then connecting the dots. You can get an image that way but it's usually just a reflection of your own bias, and people with opposite views will see opposite patterns in the same data.
In this case the story hit a software penalty for a while, which we noticed and corrected as we usually do eventually. This software works well most of the time but unfortunately not always. Either way, it has nothing to do with our opinions about Apple, which is fortunate because we don't particularly have any.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#784People still use this thing !?
Re: macOS High Sierra: Anyone can login as “root” with empty password
#785Earlier quoted context omitted.
That’s absolutely terrible. Does Apple not monitor those forums at all?
Apple's support forums aren't a place where Apple provides their users with support, they're where Apple users seek support from other Apple users, mostly unhelpful and often inaccurate support. In fact, 99% of the time the only advice you'll get is "restore your iPhone", "restore your MacBook Pro", "restore your Apple TV" and so on into bitter infinity.
Those are the support forums, GP is asking about developer forums.
Yes, Apple monitors them, but apparently not closely enough :/
Re: macOS High Sierra: Anyone can login as “root” with empty password
#786I've been a developer for a long time. I understand bugs happen, even bugs with terrible consequences. A lot of bugs seem understandable, like I can see the chain of ifs/thens required to end up at some hilarious broken state. But I'm breaking my brain trying to figure out how in the hell a login attempt for "root" will enable it if it's disabled. Why is this is a possibility, to just enable root, no questions asked?
I hope a judge will order Apple to make all source code of macOS to be readable by everyone. This does not necessarily mean open source: you will not be allowed to modify and re-release it.
And that will help because Open Source security is so great?
Or because people care to inspect the codebases they otherwise use?
Re: macOS High Sierra: Anyone can login as “root” with empty password
#787I've been a developer for a long time. I understand bugs happen, even bugs with terrible consequences. A lot of bugs seem understandable, like I can see the chain of ifs/thens required to end up at some hilarious broken state. But I'm breaking my brain trying to figure out how in the hell a login attempt for "root" will enable it if it's disabled. Why is this is a possibility, to just enable root, no questions asked?
Seems to be something related to a backwards-compatibility code path for upgraded systems. According to multiple posts on this thread it only affects systems upgraded to High Sierra, not fresh installs. See https://news.ycombinator.com/item?id=15802622 for example. Adding extra layers for compatibility complicates testing and debugging. With this many eyes on it hopefully someone will be able to deduce exactly what's…
My upgraded high sierra doesn't have this problem. The theory could be backwards. Anyways, this is stunning.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#788Just in case it is relevant for anyone here this is what our security team have established thus far: - Can be mitigated by enabling the root user with a strong password - Can be detected with `osquery` using `SELECT * FROM plist WHERE path = "/private/var/db/dslocal/nodes/Default/users/root.plist" AND key = "passwd" AND length(value) > 1;";` - You can see what time the root account was enabled using `SELECT * FROM p…
> Can be mitigated by enabling the root user with a strong password Instructions from Apple: https://support.apple.com/en-us/HT204012
And if you're thinking that manually disabling root might also fix this, it won't. You have to leave root enabled.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#789Earlier quoted context omitted.
Take this for the anecdata that it is. I interviewed at Apple, referred by old Microsoft friends that worked there. As I was trying to get a feel for things before the interview, I asked about the software testing. I was told, "don't expect what you're used to at Microsoft". The reference there is from when Microsoft often had more testers on a team than devs (ah, the good ol' days). The summary of what I was told by…
As a Tester myself, I cannot understand why this is not covered by either unit tests or behavioral tests. Clicking dialog buttons in rapid succession is what we (should) do once in a while. Especially in core functionalities such as the login screen. It's one of the first screens you see as a tester. And you have default usernames, be it enabled or not. For example, I do not own an iPhone, but at work, I made a bet w…
This bug isn't caused by rapid succession or whatever, it's more of a generic end to end test. In this case someone would have had to write an exact scenario that opens a settings page, unlocks it, types in 'root', no password, presses login and it should not work.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#790Earlier quoted context omitted.
osquery is not a built-in tool. You can get the same info with plutil(1): $ sudo plutil -p /private/var/db/dslocal/nodes/Default/users/root.plist If I understand OP correctly, if passwd is a lone asterisk, then you haven't been exploited. Edit: trying a little harder to dump accountPolicyData: $ sudo defaults read /private/var/db/dslocal/nodes/Default/users/root.plist accountPolicyData | grep -oE '[[:xdigit:]]+' | xx…
`sudo dscl . -read Users/root accountPolicyData`
When you do this you'll get the creationTime and passwordLastSetTime as seconds since the 'epoch' – January 1, 1970, 00:00:00 (UTC). These are numbers like 1474441704.265237 which aren't very easy for a human to read :-)
To convert this into a human-readable date and time, open a terminal and do this:
python
>>> import time
>>> time.strftime("%a, %d %b %Y %H:%M:%S", time.localtime(1474441704.265237))
(I'm sure you can do this in other languages than python...)