macOS High Sierra: Anyone can login as “root” with empty password • Hacker News Board

Re: macOS High Sierra: Anyone can login as “root” with empty password

#91

Post by ams6110 » Tue, Nov 28, 2017, 8:32 PM UTC

kylehotchkiss wrote: post #49

Does this bypass filesystem encryption?

It might, if you added "root" as a user able to unlock the disk. But you'd probably have needed to set a password for the root account to do that.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#92

Post by sccxy » Tue, Nov 28, 2017, 8:33 PM UTC

I wouldn't have thought that NSA backdoors are so simple

Re: macOS High Sierra: Anyone can login as “root” with empty password

#93

Post by estevaovix » Tue, Nov 28, 2017, 8:33 PM UTC

The solution for now is to set a passwd for root... this is ridiculous

Re: macOS High Sierra: Anyone can login as “root” with empty password

#94

Post by mikeash » Tue, Nov 28, 2017, 8:33 PM UTC

For those who can't make it happen, it requires that the root account is disabled, which is the default. If you already enabled the root account for some other reason (which apparently I had on one of my Macs, although I don't know why) then that prevents it from working.

It seems like the best mitigation for the moment might be to enable the root user and set a password for it.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#95

Post by m11r » Tue, Nov 28, 2017, 8:33 PM UTC

Cshelton wrote: post #39

joe_hills wrote: post #7

I just tested this on a Sierra (10.12.6) machine, and verified this bug isn't present in that earlier OSX version.

Same, I'm on 10.12.6, could not reproduce anywhere. I think I'll hold off on that 10.13.1 "security update" it keeps bugging me about. Seems to let anyone use my computer... Edit: After looking a little further, it seems staying on Sierra will always be a 10.12.* version, and High Sierra is 10.13.*?

Yes, that's correct. Recent macOS (nee OS X) versions:

- Mavericks (10.9.x)

- Yosemite (10.10.x)

- El Capitan (10.11.x)

- Sierra (10.12.x)

- High Sierra (10.13.x)

Re: macOS High Sierra: Anyone can login as “root” with empty password

#96

Post by [deleted] » Tue, Nov 28, 2017, 8:34 PM UTC

[deleted]

Re: macOS High Sierra: Anyone can login as “root” with empty password

#97

Post by Asmod4n » Tue, Nov 28, 2017, 8:34 PM UTC

nathancahill wrote: post #48

Fix this by setting a password for root (or disable). Instructions here: https://support.apple.com/en-us/HT204012

Doesn't help to disable it, you have to change the password. UPDATE: if you disable the account after setting a password, a login without a password is possible again ..

Re: macOS High Sierra: Anyone can login as “root” with empty password

#98

Post by hobonumber1 » Tue, Nov 28, 2017, 8:34 PM UTC

quicklime wrote: post #43

Anyone else think it was a bad idea to disclose this so publicly over Twitter? I thought that the usual practice was to let the development team know first.

He just wants attention.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#99

Post by zaro » Tue, Nov 28, 2017, 8:35 PM UTC

Wow. This is fun. I remember my Windows98 had the same feature. You just use Administrator with empty password and you're in. Apple is finally catching up.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#100

Post by pilif » Tue, Nov 28, 2017, 8:35 PM UTC

notanai wrote: post #13

Can this be used remotely? Edit: Yes, after turning on Remote Management on my second mac I was able to log into it using Remote Desktop, account root and no pw. It only works after getting physical access once.

It only works after getting physical access once to enable the root user by gibing any password UI the root user with no password (which will enable the local root account, which is also why it fails the first time around)