Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

1–10 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#2

Post by josho »

Confirmed that root with no password unlocks the preferences pane. But, changing the require password after screen saver setting doesn't take effect. So, it seems to be a bug in the UI not an actual vulnerability.

edit: I stand corrected. The 'require password' setting under Security Preferences didn't change, but other settings do. Yikes

Re: macOS High Sierra: Anyone can login as “root” with empty password

#3

Post by jameskilton »

josho wrote: post #2

Confirmed that root with no password unlocks the preferences pane. But, changing the require password after screen saver setting doesn't take effect. So, it seems to be a bug in the UI not an actual vulnerability. edit: I stand corrected. The 'require password' setting under Security Preferences didn't change, but other settings do. Yikes

Oh this is a real vulnerability. It's possible to switch your user to System Administrator using "root" and no password.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#4

Post by vladikoff »

josho wrote: post #2

Confirmed that root with no password unlocks the preferences pane. But, changing the require password after screen saver setting doesn't take effect. So, it seems to be a bug in the UI not an actual vulnerability. edit: I stand corrected. The 'require password' setting under Security Preferences didn't change, but other settings do. Yikes

I have "Guest User" disabled normally. This allowed me to switch Guest User on, log out, login as `root` into OS X. lol

Re: macOS High Sierra: Anyone can login as “root” with empty password

#8

Post by joshvm »

afiler wrote: post #6

Even on El Capitan, I was able to unlock with "root" on my first try. From there, I could add a new admin user. This seems... not good.

I wasn't able to do it on 10.12.6 (Sierra) though, so perhaps there's something else odd here?

Re: macOS High Sierra: Anyone can login as “root” with empty password

#9

Post by jobu »

afiler wrote: post #6

Even on El Capitan, I was able to unlock with "root" on my first try. From there, I could add a new admin user. This seems... not good.

When I tried to make a new user after unlocking as "root" it ended up making a group instead. (High Sierra 10.13.1)
Post reply on HN