Apple uses the slogan for High Sierra: "Your Mac. Elevated."
Kind of ironic that you can easily get elevated privileges with it.
macOS High Sierra: Anyone can login as “root” with empty password
811–820 of 1001 posts
Re: macOS High Sierra: Anyone can login as “root” with empty password
#812This is hilarious. I wonder why it took so long for this bug to be discovered, I mean, wasn't High Sierra released back in September?
Re: macOS High Sierra: Anyone can login as “root” with empty password
#813Anyone else think it was a bad idea to disclose this so publicly over Twitter? I thought that the usual practice was to let the development team know first.
its such a braindead problem that its plausible that the person who disclosed it over twitter didn't know what responsible disclosure is.
Usually exploits are hard to exploit meaning that those who find them likely know of responsible disclosure. In this case though anyone who has ever installed Linux is capable of stumbling upon this.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#814I wonder what is going on with software quality and testing at Apple. It feels like recently there have been quite a few issues like this (the FileVault password bug, numerous issues with iOS 11, the issue that totally broke iOS Safari a couple of years ago) which should have been fairly easily caught, especially given the limited range of devices their software runs on. I know testing is hard, but a company with App…
The loss of people like Avie Tevanian and Bertrand Serlet took its toll. Are there any "(tech) household name" engineers doing system-level work on iOS/macOS these days? It seems like Google and Facebook have a slew of them.
Dominic Giampaolo of BeOS/BeFS fame. He now works on APFS at Apple. Their work is really - impressive APFS was announced in June 2016 and rolled out on iOS devices in March 2017. Given that the APFS roll-out was relatively uneventful and how they tested it [1], it seems that they can still do low-level engineering and proper testing.
Of course, until recently they had Chris Lattner as well.
[1] For some iOS releases, they converted HFS to APFS in-place, report the results back to Apple, but did not write the APFS 'superblock' to keep the filesystem HFS+. It's quite a smart idea, because they got reports from millions of devices without actually switching them to APFS.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#815I guess we finally figured out what the "insanely" great products was all about.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#816Earlier quoted context omitted.
As a Tester myself, I cannot understand why this is not covered by either unit tests or behavioral tests. Clicking dialog buttons in rapid succession is what we (should) do once in a while. Especially in core functionalities such as the login screen. It's one of the first screens you see as a tester. And you have default usernames, be it enabled or not. For example, I do not own an iPhone, but at work, I made a bet w…
This bug isn't caused by rapid succession or whatever, it's more of a generic end to end test. In this case someone would have had to write an exact scenario that opens a settings page, unlocks it, types in 'root', no password, presses login and it should not work.
In this case, any password works. The blank one is just the initial example. The password is set to whatever you typed, even if nothing.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#817I wonder what is going on with software quality and testing at Apple. It feels like recently there have been quite a few issues like this (the FileVault password bug, numerous issues with iOS 11, the issue that totally broke iOS Safari a couple of years ago) which should have been fairly easily caught, especially given the limited range of devices their software runs on. I know testing is hard, but a company with App…
And seeing this I am wondering why people still trust closed-source software. My long term dream is using 100% free software on a HW with minimum binary blobs.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#818How come nobody has picked a name for this vulnerability?
Re: macOS High Sierra: Anyone can login as “root” with empty password
#819Earlier quoted context omitted.
Take this for the anecdata that it is. I interviewed at Apple, referred by old Microsoft friends that worked there. As I was trying to get a feel for things before the interview, I asked about the software testing. I was told, "don't expect what you're used to at Microsoft". The reference there is from when Microsoft often had more testers on a team than devs (ah, the good ol' days). The summary of what I was told by…
> But since I don't work there, I have no good inside info Actually, I've been wondering why I hear less about people working at Apple than at other big tech companies. It seems everyone and their mother work at Google or Facebook, but no so much at Apple. Do they have less software engineers, or their employees are required to be more discrete?
[deleted]
Re: macOS High Sierra: Anyone can login as “root” with empty password
#820I've been a developer for a long time. I understand bugs happen, even bugs with terrible consequences. A lot of bugs seem understandable, like I can see the chain of ifs/thens required to end up at some hilarious broken state. But I'm breaking my brain trying to figure out how in the hell a login attempt for "root" will enable it if it's disabled. Why is this is a possibility, to just enable root, no questions asked?
Seems to be something related to a backwards-compatibility code path for upgraded systems. According to multiple posts on this thread it only affects systems upgraded to High Sierra, not fresh installs. See https://news.ycombinator.com/item?id=15802622 for example. Adding extra layers for compatibility complicates testing and debugging. With this many eyes on it hopefully someone will be able to deduce exactly what's…
But at one point a root account is created with an empty password right?
There's a specific line somewhere that's doing this, in theory.
Maybe they should have opted for "create `root` with unguessable password"