Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

821–830 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#821

Post by [deleted] »

adamio wrote: post #409
tomduncalf wrote: post #266

I wonder what is going on with software quality and testing at Apple. It feels like recently there have been quite a few issues like this (the FileVault password bug, numerous issues with iOS 11, the issue that totally broke iOS Safari a couple of years ago) which should have been fairly easily caught, especially given the limited range of devices their software runs on. I know testing is hard, but a company with App…

Repressive collusion to fix salaries and restrict industry movement, doesn't really inspire your employees to try their best

[deleted]

Re: macOS High Sierra: Anyone can login as “root” with empty password

#822

Post by api »

zaidf wrote: post #436
tomduncalf wrote: post #266

I wonder what is going on with software quality and testing at Apple. It feels like recently there have been quite a few issues like this (the FileVault password bug, numerous issues with iOS 11, the issue that totally broke iOS Safari a couple of years ago) which should have been fairly easily caught, especially given the limited range of devices their software runs on. I know testing is hard, but a company with App…

Unrelated to Mac OS but I used to wonder all the time why iTunes connect was so shoddy. I got my answer when I learned Apple had outsourced a ton of backend work including iTunes Connect, App Store backend to Infosys in India. They’re now retreating from that strategy: https://factordaily.com/apple-to-pull-back-development-work-...

Everyone retreats from that strategy.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#823

Post by chmars »

dtf wrote: post #704

Amazingly, this was disclosed offhand on the Apple developer forums, two weeks ago (see final comment by chethan177): https://forums.developer.apple.com/thread/79235 (spotted by https://twitter.com/fristle/status/935670476214378496 )

… as a _workaround_ for an administrator account-related bug.

I should have known that updating to a new MacOS versions before 6 to 9 months have passed is a mistake. High Sierra is in my experience the buggiest MacOS release so far, not only security-wise. The system is not very stable and APFS reduced drive performance … :(

Re: macOS High Sierra: Anyone can login as “root” with empty password

#825

Post by mhandley »

timsutton wrote: post #756
RJIb8RBYxzAMX9u wrote: post #614

Earlier quoted context omitted.

osquery is not a built-in tool. You can get the same info with plutil(1): $ sudo plutil -p /private/var/db/dslocal/nodes/Default/users/root.plist If I understand OP correctly, if passwd is a lone asterisk, then you haven't been exploited. Edit: trying a little harder to dump accountPolicyData: $ sudo defaults read /private/var/db/dslocal/nodes/Default/users/root.plist accountPolicyData | grep -oE '[[:xdigit:]]+' | xx…

`sudo dscl . -read Users/root accountPolicyData`

One of my Macs is showing a root password change date of Nov 10th 2017. I can't explain that, so I'm reinstalling now. It did have sshd enabled and remotely accessible, though I thought root login was prohibited.

If I understood correctly, this particular bug was only exploitable from the GUI and this machine hasn't been away from home, so it's likely this isn't related, but posting here, in case it's part of a bigger picture.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#826

Post by orf »

xer0x wrote: post #787
OkGoDoIt wrote: post #575

Earlier quoted context omitted.

Seems to be something related to a backwards-compatibility code path for upgraded systems. According to multiple posts on this thread it only affects systems upgraded to High Sierra, not fresh installs. See https://news.ycombinator.com/item?id=15802622 for example. Adding extra layers for compatibility complicates testing and debugging. With this many eyes on it hopefully someone will be able to deduce exactly what's…

My upgraded high sierra doesn't have this problem. The theory could be backwards. Anyways, this is stunning.

Mine is an upgrade and does.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#828

Post by pasta »

k3a wrote: post #817
tomduncalf wrote: post #266

I wonder what is going on with software quality and testing at Apple. It feels like recently there have been quite a few issues like this (the FileVault password bug, numerous issues with iOS 11, the issue that totally broke iOS Safari a couple of years ago) which should have been fairly easily caught, especially given the limited range of devices their software runs on. I know testing is hard, but a company with App…

And seeing this I am wondering why people still trust closed-source software. My long term dream is using 100% free software on a HW with minimum binary blobs.

This also can happen in open software. So I don't think your comment is valid.

Open software enables people to take a look inside to what is going on. It isn't a cure for bug free development.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#829

Post by cherimoya »

skygazer wrote: post #810
dec0dedab0de wrote: post #370

Earlier quoted context omitted.

I'm having a hard time understanding how this could happen too. It would have to be that looking up the root account enabled it, maybe users go dormant or something, and this was a way to readd them? then once it was enabled it defaulted to a blank password, but you would think that it needs sudo to enable root in the first place.

Blank password is not necessary. Any password provided on initial attempt WILL BECOME the root password. Blank is being circulated simply because that's what was discovered first. Edit: Which also means it's possible to "secure" a vulnerable (unexploited) machine simply by attempting to log in as root with a long random password.

So by my logic - if you tried this exploit and it failed the first time, then worked the second time: No one else has tried it before you. Otherwise it would either have worked the first time (if you guessed the same pass) or not worked at all (if the first time it was tried a different pass was used).

Or is this not a permanent password set?

Re: macOS High Sierra: Anyone can login as “root” with empty password

#830

Post by 3131s »

dang wrote: post #783
3131s wrote: post #754

Earlier quoted context omitted.

Not the first time I've noticed this with threads that are bad PR for Apple.

Be careful about noticing a few data points and then connecting the dots. You can get an image that way but it's usually just a reflection of your own bias, and people with opposite views will see opposite patterns in the same data. In this case the story hit a software penalty for a while, which we noticed and corrected as we usually do eventually. This software works well most of the time but unfortunately not alwa…

I didn't mean to imply that it was manipulation on the part of HN. I am wary that Apple, like any large company, might try to bury stories like this.

I know it's been asked before (by me, for one), but can you tell us anything about the protections HN has in place against astroturfing?

Post reply on HN