Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

831–840 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#831

Post by x0x0 »

raydev wrote: post #300

I've been a developer for a long time. I understand bugs happen, even bugs with terrible consequences. A lot of bugs seem understandable, like I can see the chain of ifs/thens required to end up at some hilarious broken state. But I'm breaking my brain trying to figure out how in the hell a login attempt for "root" will enable it if it's disabled. Why is this is a possibility, to just enable root, no questions asked?

OSX user management is weird. At least on prev versions, they don't show a root account in the Users & Groups ui.

A guess: there's a code path in the UI that is only tested on "mac" accounts, not the root account that the system requires to exist. Something about the non-macness of the root account interacts badly with the UI that expects to be run on a mac users account.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#832

Post by MrMid »

jenoer wrote: post #462
mikestew wrote: post #349

Earlier quoted context omitted.

Take this for the anecdata that it is. I interviewed at Apple, referred by old Microsoft friends that worked there. As I was trying to get a feel for things before the interview, I asked about the software testing. I was told, "don't expect what you're used to at Microsoft". The reference there is from when Microsoft often had more testers on a team than devs (ah, the good ol' days). The summary of what I was told by…

As a Tester myself, I cannot understand why this is not covered by either unit tests or behavioral tests. Clicking dialog buttons in rapid succession is what we (should) do once in a while. Especially in core functionalities such as the login screen. It's one of the first screens you see as a tester. And you have default usernames, be it enabled or not. For example, I do not own an iPhone, but at work, I made a bet w…

I got my friends Apple Watch stuck last week just by looking at it's features. IIRC it got stuck while using the "flashlight". It suddenly froze, and it took me a while to reboot it (it got stuck once more while rebooting).

All in all, it took me about a minute to break it, and around 5 minutes to get it working again. I was getting a bit nervous.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#833

Post by jenoer »

Cthulhu_ wrote: post #789
jenoer wrote: post #462

Earlier quoted context omitted.

As a Tester myself, I cannot understand why this is not covered by either unit tests or behavioral tests. Clicking dialog buttons in rapid succession is what we (should) do once in a while. Especially in core functionalities such as the login screen. It's one of the first screens you see as a tester. And you have default usernames, be it enabled or not. For example, I do not own an iPhone, but at work, I made a bet w…

This bug isn't caused by rapid succession or whatever, it's more of a generic end to end test. In this case someone would have had to write an exact scenario that opens a settings page, unlocks it, types in 'root', no password, presses login and it should not work.

Rapid succession button clicking usually combines many different tests:

- Performance

- Usability

- Brute-force capabilities

- Error handling

- And in this case, Security, a bug where trying to log in a couple of times on the Login screen with an empty, or set, password.

A test scenario closer to this would be:

---

When I am on the login screen

And I enter 'root' in the 'Username' field

And I enter 'thispasswordisfalse' in the 'Password' field

And I press the 'Login' button '10' times

Then I should see the text 'Your password is invalid'

---

Please note that this issue is not just in the Settings page, it takes place on the login screen as well, that's why I'm shocked, it's such a core functionality, touching so many system components.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#834

Post by marcelfahle »

mhandley wrote: post #825
timsutton wrote: post #756

Earlier quoted context omitted.

`sudo dscl . -read Users/root accountPolicyData`

One of my Macs is showing a root password change date of Nov 10th 2017. I can't explain that, so I'm reinstalling now. It did have sshd enabled and remotely accessible, though I thought root login was prohibited. If I understood correctly, this particular bug was only exploitable from the GUI and this machine hasn't been away from home, so it's likely this isn't related, but posting here, in case it's part of a bigge…

My root pw passwordLastSetTime says this morning.. the fuck??

Re: macOS High Sierra: Anyone can login as “root” with empty password

#835

Post by skygazer »

tekacs wrote: post #399
LeoPanthera wrote: post #159

Earlier quoted context omitted.

You can simply set a root password with "sudo passwd" to close the hole.

And you might want to disable the root account again with `dsenableroot -d` as well, so that the root account stays disabled after the vulnerability is patched. Unlike doing this through the GUI, this seems to retain the root password and prevent this vuln from re-occuring.

As far as I can tell, "dsenableroot -d" seems to have no useful effect. After having "* Successfully disabled root user." with it, I can still log in to the root account with the password I set, both at the command line with "login" and from a remote machine via screen sharing.

To be flippant, I might say HN discussions seem to QA using Apple methods.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#836

Post by marcelfahle »

mhandley wrote: post #825
timsutton wrote: post #756

Earlier quoted context omitted.

`sudo dscl . -read Users/root accountPolicyData`

One of my Macs is showing a root password change date of Nov 10th 2017. I can't explain that, so I'm reinstalling now. It did have sshd enabled and remotely accessible, though I thought root login was prohibited. If I understood correctly, this particular bug was only exploitable from the GUI and this machine hasn't been away from home, so it's likely this isn't related, but posting here, in case it's part of a bigge…

OK, I guess when doing OP's root trick, the root user gets activated/created, and that's that's when the PW gets set to empty. I guess that's where my passwordLastSetTime comes from.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#837

Post by philliphaydon »

LeoNatan25 wrote: post #748
philliphaydon wrote: post #707

No one else has mentioned it seems, digging through the twitter comments I found a tweet which states this was already known by Apple, and posted on the forums in the form of a solution... https://forums.developer.apple.com/thread/79235#277225

Mentioned many times actually. And the forum is users self help. It is not monitored by Apple.

Ahh the links weren’t on the first page of the HN comments when I posted. They are now. I didn’t click more. :)

Re: macOS High Sierra: Anyone can login as “root” with empty password

#838

Post by teddyh »

I see a lot of comments here wondering why Apple seems to not care about software quality anymore. I don’t know if that’s true, but there’s a perfectly obvious answer: They don’t have to.

Software quality in macOS was important back when they were trying to get people to switch from Windows-based PCs to Macs. Nowadays, most people who were going to switch have already switched, so Apple has no incentive to keep up the same level of software quality anymore. They just have to keep people locked into their ecosystem (with iPhone etc.) enough that the barrier to switch out again is high enough.

There is no reason for Apple to improve macOS, since doing so won’t make anyone switch to Macs who hasn’t already switched, and not improving macOS won’t make anyone upset enough to switch back. Ergo, Apple leaves macOS to stagnate, and they will keep macOS at this bad-but-not-horrible-enough-to-switch level for the foreseeable future.

That’s my theory, anyway.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#839

Post by akvadrako »

rtpg wrote: post #820
OkGoDoIt wrote: post #575

Earlier quoted context omitted.

Seems to be something related to a backwards-compatibility code path for upgraded systems. According to multiple posts on this thread it only affects systems upgraded to High Sierra, not fresh installs. See https://news.ycombinator.com/item?id=15802622 for example. Adding extra layers for compatibility complicates testing and debugging. With this many eyes on it hopefully someone will be able to deduce exactly what's…

But at one point a root account is created with an empty password right? There's a specific line somewhere that's doing this, in theory. Maybe they should have opted for "create `root` with unguessable password"

No, that's a hack. And it opens new attacks, like on the hashing algorithm and poor randomness or predictability in the generation logic.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#840

Post by skygazer »

teddyh wrote: post #838

I see a lot of comments here wondering why Apple seems to not care about software quality anymore. I don’t know if that’s true, but there’s a perfectly obvious answer: They don’t have to. Software quality in macOS was important back when they were trying to get people to switch from Windows-based PCs to Macs. Nowadays, most people who were going to switch have already switched, so Apple has no incentive to keep up th…

While your theory is interesting, if deeply cynical, the thing I find most interesting is that it's the top comment on an 800+ comment discussion when it was less than a minute old. Do new comments start at the top? I've never noticed that before.

Edit: By the way, regarding the vulnerability, ANY password you use when you first attempt to login as root BECOMES root's new password. (Blank is a red herring.)

So if you're going to test this, maybe use something non-obvious. In a terminal, setting a strong password for root with "sudo passwd" is the quickest mitigation.

Ill-advised, but in a pinch, you can apparently 'secure' a machine you don't otherwise have access to by attempting to log in as root with a long random password you fail to remember. An admin on that machine can later change root's password with a "sudo passwd".

Also, it appears the "dseneableroot -d" command suggested elsewhere here fails in preventing root login.

Post reply on HN