Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

981–990 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#981

Post by macandcheese »

delfinom wrote: post #917
angrygoat wrote: post #880

Earlier quoted context omitted.

These days, where is the lock-in? The core applications that I use (Firefox, Docker, VSCode, vim, ...) all work just as well on Linux, MacOS and Windows. I have a Mac, because it's (at least previously) been pretty secure by default, doesn't require me to invest a lot of time sysadmining my own box, and lets me dip into a healthy ecosystem of commercial software useful to my hobbies (like photography.) The software h…

iMessage is a huge lock-in for non-technical users. They are just obsessed with it on iOS. You can find tons of forum posts with people throwing fits that XYZ Android phone doesn't have iMessage.

I'm not sure the correlation is technical proficiency by itself, I think it's based upon a critical mass of your social circles using iMessage or not using iMessage. If you choose to, you can probably make a correlation between "technical savviness" and a user's choice between Android and Apple, but I don't think that is a deciding factor in who uses iMessage.

The reason people throw fits is because the experience between a group messaging together on iMessage is exceptional - this experience breaks down when even one of your friends in the chat doesn't have an Apple product. They aren't able to send or receive the majority of the "chat add ons" iMessage provides. I'm sure making the bubbles green vs. blue only helps to stoke the "us vs. them" fire.

I consider myself to be a reasonably technical user and still prefer to message with iMessage since I know the experience will be the same for everyone I'm chatting with. Yes, we _could_ all start using WhatsApp et al, but if 8/9 of our group message is on iMessage, why would we?

Re: macOS High Sierra: Anyone can login as “root” with empty password

#982

Post by danielrangel »

mhandley wrote: post #825
timsutton wrote: post #756

Earlier quoted context omitted.

`sudo dscl . -read Users/root accountPolicyData`

One of my Macs is showing a root password change date of Nov 10th 2017. I can't explain that, so I'm reinstalling now. It did have sshd enabled and remotely accessible, though I thought root login was prohibited. If I understood correctly, this particular bug was only exploitable from the GUI and this machine hasn't been away from home, so it's likely this isn't related, but posting here, in case it's part of a bigge…

possibly the same timestamp here: 1510300538.767916 'Fri, 10 Nov 2017 04:55:38'

Re: macOS High Sierra: Anyone can login as “root” with empty password

#983

Post by albertTJames »

lawnchair_larry wrote: post #373
fixermark wrote: post #121

Earlier quoted context omitted.

Is it likely it's just an error due to the discoverer not being immersed in the Infosec space? "Don't disclose a 0-day publicly" is good 'common' sense, but only among the 'common' of people who are steeped in security issues and the ramifications of publicizing them.

That is not the case among infosec professionals either. Many respected professionals believe that the right thing to do in many cases is full public disclosure. Google Project Zero are a notable example.

Which respected professionals ? This is completely false.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#984

Post by cmiles74 »

irishsultan wrote: post #974
cmiles74 wrote: post #959

Earlier quoted context omitted.

To some up, when you try to log in with a disabled account, MacOS "promotes" the account but uses the _password provided by the user trying to log in_ instead of the password on file (in this case, an asterisk indicating the account is disabled). Once that is done, you can log in with that account. IMHO these are two separate bugs: promoting disabled accounts and using the password the user typed in instead of the va…

I assume that it can't use the password in the password list as that should be hashed already.

I see your point, but it still seems kind of wacky to me. They should validate that the password is correct, then promote the account. Taking the password provided in the authentication dialog just seems like a bad idea.

Perhaps the root issue here is forgetting that the asterisk indicates that the account is disabled and shouldn't be a candidate for promotion.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#985

Post by oneeyedpigeon »

heartbreak wrote: post #739
oneeyedpigeon wrote: post #258

Earlier quoted context omitted.

Let's wait until Apple release their patch so we know just how long they left everyone's machines vulnerable for. That will be a factor in determining whether this disclosure was irresponsible or not. It's been two and a half hours so far.

If Apple released a patch in less than 24 hours I’d be seriously concerned about the QA that had gone into the patch.

I guess you’re seriously concerned now ;)

Re: macOS High Sierra: Anyone can login as “root” with empty password

#986

Post by eridius »

afiler wrote: post #6

Even on El Capitan, I was able to unlock with "root" on my first try. From there, I could add a new admin user. This seems... not good.

The bug does not exist on El Capitan. Your description tells me you already had the root user enabled with no password (which is something you can do with Directory Utility.app)

Re: macOS High Sierra: Anyone can login as “root” with empty password

#988

Post by krock »

abritishguy wrote: post #534

Just in case it is relevant for anyone here this is what our security team have established thus far: - Can be mitigated by enabling the root user with a strong password - Can be detected with `osquery` using `SELECT * FROM plist WHERE path = "/private/var/db/dslocal/nodes/Default/users/root.plist" AND key = "passwd" AND length(value) > 1;";` - You can see what time the root account was enabled using `SELECT * FROM p…

apple have a security update out now: https://support.apple.com/en-au/HT208315

Re: macOS High Sierra: Anyone can login as “root” with empty password

#989

Post by gluestic »

piyush_soni wrote: post #792
gluestic wrote: post #477

Earlier quoted context omitted.

Agreed. iOS 11 was the tipping point for me (can't delete photos using trash icon, wrong orientation when unlocking phone, random lag/freezes etc). Apple just doesn't care any more.

Unless you buy Apple Care, of course. (Sorry, couldn't resist writing :) )

I chuckled.
Post reply on HN