Top 10 software blunders of all time: 1) (Apple) 1 + 2 + 3 = 24 https://news.ycombinator.com/item?id=15538666 2) (Apple) Blank root password https://news.ycombinator.com/item?id=15800676 3) ...
macOS High Sierra: Anyone can login as “root” with empty password
871–880 of 1001 posts
Re: macOS High Sierra: Anyone can login as “root” with empty password
#872Is this also in 10.13.2 beta?
Re: macOS High Sierra: Anyone can login as “root” with empty password
#873Anyone else think it was a bad idea to disclose this so publicly over Twitter? I thought that the usual practice was to let the development team know first.
If the vulnerability required scripting or special tools to be written, yes, it should be disclosed in private. But anyone can happen upon this, and I imagine the reaction for most is "Huh! That's funny! My friends and followers would get a kick out of this!" He was just being social about a problem he found with his new computer, which is something most people would do upon finding a something you can laugh about.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#874Earlier quoted context omitted.
Apple's support forums aren't a place where Apple provides their users with support, they're where Apple users seek support from other Apple users, mostly unhelpful and often inaccurate support. In fact, 99% of the time the only advice you'll get is "restore your iPhone", "restore your MacBook Pro", "restore your Apple TV" and so on into bitter infinity.
Those are the support forums, GP is asking about developer forums. Yes, Apple monitors them, but apparently not closely enough :/
Yeah, I miss the days back at the start of the decade when I would brim with delight over an email notification that a senior engineer / moderator had chimed-in on my thread on the Apple dev forums.
Checking the dev forums was my favourite thing to do in IT class at school :)
These days, I get that (especially now that they're open) the forums are too saturated with content to have engineers on the ball all the time... But the Captain Hindsight in me thinks they could have done with some keyword notifications to nip instances like this in the bud...
Re: macOS High Sierra: Anyone can login as “root” with empty password
#875Amazingly, this was disclosed offhand on the Apple developer forums, two weeks ago (see final comment by chethan177): https://forums.developer.apple.com/thread/79235 (spotted by https://twitter.com/fristle/status/935670476214378496 )
… as a _workaround_ for an administrator account-related bug. I should have known that updating to a new MacOS versions before 6 to 9 months have passed is a mistake. High Sierra is in my experience the buggiest MacOS release so far, not only security-wise. The system is not very stable and APFS reduced drive performance … :(
From one bad upgrade that cost me a bunch of productivity - believe it was Lion - as well as observing the struggles of colleagues, these days always wait 6 months at least before upgrading OSX
Re: macOS High Sierra: Anyone can login as “root” with empty password
#876This is why I use disk encryption.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#877I see a lot of comments here wondering why Apple seems to not care about software quality anymore. I don’t know if that’s true, but there’s a perfectly obvious answer: They don’t have to. Software quality in macOS was important back when they were trying to get people to switch from Windows-based PCs to Macs. Nowadays, most people who were going to switch have already switched, so Apple has no incentive to keep up th…
While I think there's a chance you might be right, I don't think it's logical in the long run. I think changes in perception like this are accumulated over time and will in the end hurt the product.
For some examples, look at the impression of Microsoft and Windows when it comes to quality. It is only now starting to improve, with gigantic efforts from Microsofts side. Another example is Linux and usability, which have constantly gotten better (maybe still not good enough, but that's better left for another thread) but still many see Linux as "advanced" and only for power users. These are not perfect examples, of course.
What I mean is that I think it's bad strategy on Apple's part (if they're doing this deliberately), especially considering the resources they have at their hands. I wouldn't be surprised if Apple could increase it's desktop market share further by positioning themselves as high quality. However, it's a reputation they are losing fast.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#878Earlier quoted context omitted.
While your theory is interesting, if deeply cynical, the thing I find most interesting is that it's the top comment on an 800+ comment discussion when it was less than a minute old. Do new comments start at the top? I've never noticed that before. Edit: By the way, regarding the vulnerability, ANY password you use when you first attempt to login as root BECOMES root's new password. (Blank is a red herring.) So if you…
The higher the poster's karma, the higher her comment will be upon posting. This user has almost 6k karma, so it can rise high. Once the comment is at the top for a minute or so, it can stay there if enough people keep upvoting it. Try it and post a top level comment now. I'm pretty sure it won't be at the top initially because you don't have enough karma for that.
Ah thanks, now it makes sense. I always wondered why sometimes my comments went straight to the top. I've lost too much productivity here, clearly! ;)
Re: macOS High Sierra: Anyone can login as “root” with empty password
#879Earlier quoted context omitted.
osquery is not a built-in tool. You can get the same info with plutil(1): $ sudo plutil -p /private/var/db/dslocal/nodes/Default/users/root.plist If I understand OP correctly, if passwd is a lone asterisk, then you haven't been exploited. Edit: trying a little harder to dump accountPolicyData: $ sudo defaults read /private/var/db/dslocal/nodes/Default/users/root.plist accountPolicyData | grep -oE '[[:xdigit:]]+' | xx…
Bad news: I tried the exploit in my macOS Sierra installation and it didn't seem to work. However, the passwd entry on the output of your first command IS A LONE ASTERISK. However I still can't login as root. This leads me to believe this behavior has always been there, and maybe the login methods just didn't allow an empty password.
Only High Sierra is affected.
Re: macOS High Sierra: Anyone can login as “root” with empty password
#880I see a lot of comments here wondering why Apple seems to not care about software quality anymore. I don’t know if that’s true, but there’s a perfectly obvious answer: They don’t have to. Software quality in macOS was important back when they were trying to get people to switch from Windows-based PCs to Macs. Nowadays, most people who were going to switch have already switched, so Apple has no incentive to keep up th…
These days, where is the lock-in?
The core applications that I use (Firefox, Docker, VSCode, vim, ...) all work just as well on Linux, MacOS and Windows.
I have a Mac, because it's (at least previously) been pretty secure by default, doesn't require me to invest a lot of time sysadmining my own box, and lets me dip into a healthy ecosystem of commercial software useful to my hobbies (like photography.)
The software has definitely declined in quality, but not enough to massively annoy me.
If there is lock-in, it's on the hardware side. I've got an early 2013 MBP, still going strong, a bit dented but it's been around the world with me a few times, so that's understandable.
My workplace uses Dell XPS hardware, and that's good, but it still doesn't feel as solid to me. It's good, but it's not as good.
I think the hardware is the laurel Apple has really been resting on.
I could meet my main use cases on Linux quite happily, and dual-boot Windows for the rest. Right now the premium on Mac hardware, which only happily runs an increasingly decrepit operating system, isn't looking worth it. Previously, it was.