Pro tip: You can log into macOS High Sierra as root with no password

Minimalist · Nov 28, 2017

A trivial to exploit flaw in macOS High Sierra allows users to get admin rights without a password.

The bug occurs on the Mac's admin login window (the one that appears when you want to install an app or change system settings) when a user enters "root" as the username and leaves password box blank.

If the user hits "enter" and clicks the mouse multiple times, the dialog box disappears and the user is granted root access.
Click to expand...

https://www.theregister.co.uk/2017/11/28/root_access_bypass_macos_high_sierra/

ronjor · Nov 28, 2017

A newly-discovered flaw in macOS High Sierra — Apple’s latest iteration of its operating system — allows anyone with local (and, apparently in some cases, remote) access to the machine to log in as the all-powerful “root” user without supplying a password. Fortunately, there is a simple fix for this until Apple patches this inexplicable bug: Change the root account’s password now.
Click to expand...

https://krebsonsecurity.com/2017/11/macos-high-sierra-users-change-root-password-now/

ronjor · Nov 29, 2017

Patched. https://www.wilderssecurity.com/threads/apple-security-updates.368333/page-4#post-2721904

Minimalist · Nov 30, 2017

Apple’s Emergency macOS Root Security Patch Breaks Down System Feature

Apple was quite in a rush to release an emergency patch for the macOS vulnerability that allowed anyone to get root access to its computers, and while the flaw is fixed, it turns out that the update itself is causing some extra problems on systems that install it.

Apple has confirmed that the Security Update 2017-001 for macOS High Sierra 10.13.1 breaks down file sharing, also providing a bunch of instructions on how to fix this until another patch is shipped.
Click to expand...

http://news.softpedia.com/news/appl...patch-breaks-down-system-feature-518779.shtml

Minimalist · Dec 2, 2017

A bug bounty wouldn't have helped Apple spot the macOS root flaw

Responsible disclosure is encouraged by so-called bug-bounty programs, when companies pay security researchers for reporting such flaws. They’re popular across the tech world and in 2016 alone Google paid out $3 million. Facebook, Tesla, Microsoft and Uber all have similar programs. Even non-tech companies are using them: Bugcrowd’s State of Bug Bounty report revealed enterprise adoption of such programs was up 300 per cent last year.

But while Apple has an invite-only bug bounty programme for iOS, it doesn’t pay out for flaws found with macOS. Critics suggest that means researchers are less likely to dig about in macOS code looking for flaws. “Bug bounty programs help further incentivise hackers to spend more time looking for bugs,” says Alex Rice, co-founder and CTO of HackerOne. “Bounties can help attract more attention from a broader audience, meaning you’ll have more people testing the security of your software.”
Click to expand...

http://www.wired.co.uk/article/macos-high-sierra-root-access-security-apple-bug-bounty-program

Minimalist · Dec 4, 2017

Apple’s Sloppy Software Stories Just Keep Coming – What’s Up with the iPhone Maker?

Reports reveal that several Mac users who weren’t on the latest version of High Sierra – macOS 10.13.1 – but were on 10.13.0 and installed this security patch without first upgrading to the latest OS version, have spotted seeing this “root” issue reappearing when they install the latest macOS update. Apple had apparently assumed that Mac users would first upgrade to the new version before applying this security patch.

However, in all the social media outcry over this security issue, it makes sense that many were eager to install this security update before they could upgrade to the latest macOS version. In addition to this, Wired reports that at least two Mac users have confirmed that the root problem persists even if they go ahead to reinstall this security patch until they reboot their computer – something that Apple didn’t say was necessary.
Click to expand...

https://wccftech.com/apple-macos-root-did-it-really-fix/

Log in or Sign up

Pro tip: You can log into macOS High Sierra as root with no password

Minimalist Registered Member

ronjor Global Moderator

ronjor Global Moderator

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Log in or Sign up

Pro tip: You can log into macOS High Sierra as root with no password

Minimalist Registered Member

ronjor Global Moderator

ronjor Global Moderator

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Useful Searches