macOS High Sierra bug allows Admin access without password

cwa107 · Nov 29, 2017

Cr00zng said:
This bug seems really bad...

Once you assign a password to the root account, it is seemingly a workaround for this bug. But, if you follow the recommendation of disabling the root account afterward, you might be in for a surprise.

Go ahead and try changing system settings, after the password is set and the root account disabled:

Type in root and no password for admin credentials in the authentication window and press enter

do the same again and voila, you have root access

At the first time, the system will enable the root account and sets the password to blank. At the second try, it'll just log you in, just like it worked initially. I've seen a lot of serious bugs before, but this one is the worst ever!

Leaving the root account enabled, not recommended by Apple, seemingly prevents this bug to resurface. The side effect is that, if you look in the logs there is a failed authorization and then it succeeds in spite of that. Awesome Apple, one of the system process relies on the root account without password. Are you !@#$ serious!!

Agreed. I am still in stunned disbelief.

Lifeisabeach · Nov 29, 2017

chscag said:
This is the second time we had to move a post to a thread that already exists. Please guys and gals.... let's pay attention to what has already been posted. Also, this is the correct forum as it refers to macOS security.

Thanks.

Ah nuts. I checked but completely overlooked this sub-forum. I thought it was odd that no one else had seen and reported it yet. #facepalm

Lifeisabeach · Nov 29, 2017

cwa107 said:
The funny thing is that you have to "enable" root before you can even change the password, and then in-turn, disable it.

From what I've read, you are re-enabling the flaw by disabling root, even after changing the password.

cwa107 · Nov 29, 2017

Lifeisabeach said:
From what I've read, you are re-enabling the flaw by disabling root, even after changing the password.

Seriously... wow. How has Apple not patched this thing yet??!?

Lifeisabeach · Nov 29, 2017

cwa107 said:
Seriously... wow. How has Apple not patched this thing yet??!?

It gets better. If you read through the comments for the Ars Technica article I linked to, someone casually posted a comment in Apple's developer forums 2 weeks ago using this bug as a solution to login issues. So it wasn't suddenly discovered yesterday.... it's been known for who knows how long.
https://forums.developer.apple.com/thread/79235#277225

Apple has issued a security update today to patch this.
https://arstechnica.com/gadgets/2017/11/new-security-update-fixes-macos-root-bug/

Raz0rEdge · Nov 29, 2017

Critical fix has been released by Apple, visit the App Store and update immediately.

cwa107 · Nov 29, 2017

Lifeisabeach said:
It gets better. If you read through the comments for the Ars Technica article I linked to, someone casually posted a comment in Apple's developer forums 2 weeks ago using this bug as a solution to login issues. So it wasn't suddenly discovered yesterday.... it's been known for who knows how long.
https://forums.developer.apple.com/thread/79235#277225

Unbelievable! I mean, this is just inexcusable -- can you imagine the fallout if Microsoft left such a severe security hole unpatched for nearly 24 hours (since it was very publicly announced)?

Apple has issued a security update today to patch this.
https://arstechnica.com/gadgets/2017/11/new-security-update-fixes-macos-root-bug/

Thanks for that.... I've been scanning my updates periodically, just grabbed it now. But really, if heads aren't rolling at Apple, they should be. This is one of the largest technology companies in the world, I can't understand how this even happens.

Cr00zng · Nov 29, 2017

I've just installed the patch and tested it...

The patch does disable the root account, mine was enabled with password, and blank PWD does not work. Well, at least not after five tries. Yes, my honey-moon with macOS is over by now... :Not-Amused:

pm-r · Nov 29, 2017

macgig said:
https://www.komando.com/happening-n...macos-until-this-major-security-flaw-is-fixed

Hmmm… typical erroneous Kim Komando type statement at the time with a posted subject showing "..-flaw-is-fixed" in the link.

But apparently has been now with a recent Apple Update update.

Opps, sorry Ashwin, I missed your earlier post somehow…

- Patrick
======

pm-r · Nov 29, 2017

Cr00zng said:
I've just installed the patch and tested it...

The patch does disable the root account, mine was enabled with password, and blank PWD does not work. Well, at least not after five tries. Yes, my honey-moon with macOS is over by now…

Mmmm…??? And to think I've been running my Macs for well over ten years without a username password.

It's actually quite nice not being nagged all the time but I do have to hit a keyboard key when asked. :Mischievous:

But not quite the same only using the Macs in a private household with only my wife as company compared to other situations.

- Patrick
======

Cr00zng · Nov 29, 2017

pm-r said:
Mmmm…??? And to think I've been running my Macs for well over ten years without a username password.

It's actually quite nice not being nagged all the time but I do have to hit a keyboard key when asked.

But not quite the same only using the Macs in a private household with only my wife as company compared to other situations.

- Patrick
======

I've only got a MacBook for supporting my clients, who have Mac and/or MacBook. Since my wife uses it for business purposes only by now, it is kept up to date and I can also learn things.Also dumped my Windows smartphone since despite the fact that I offered no support for iPhones, my clients kept asking me for helping them with the iPhones and pretty much had no choice. I missed my Windows 8.1 smartphone....

Here's a detailed look at the background for this bug, very detailed and easy to read:

https://objective-see.com/blog/blog_0x24.html

Coming from the Windows world, I didn't anticipate that macOS will start to look a lot like Windows. It's a harsh sentence and probably over the board, but I think that Apple should listen...

cwa107 · Nov 29, 2017

It's one thing to have no password on your account, it's another to allow a low-level system account that has completely unfettered access to go without a password. I believe OS X will still prompt you for administrator credentials even with no password.... but root is another story. As I said before, one doesn't need physical access to exploit a security flaw like that. All I have to do is get you to double-click on something as simple as a script that installs a service that runs as root. Then, I have a backdoor into your machine and I can make it do my bidding. Or, I can simply peruse your machine remotely to find files that I deem of value for any number of nefarious purposes.

Disabling root and setting a password is security for *nix 101. I can't even remember the last Linux distro I saw with a root account that allowed interactive sessions, it's probably been close to 20 years.

dtravis7 · Nov 29, 2017

I still can not understand why my iMac would not log me into root like that but who knows. It's obvious there was a fault and for many it did work. A patch did show up for it in software update on the imac and it's installed.

Also thank you Cr00zng for posting that URL. That showed exactly what it did and how it got in. Excellent info.

Rod · Nov 29, 2017

There you go Dennis, tha advantages and disadvantages of not upgrading but I guess you've gone as far as you can. This morning i read an artical on iMore that states that the patch released by Apple for this "root" threat may have caused file sharing issues for some and they have published a fix for this. http://rss.tapatalk.com/aHR0cHM6Ly9...vbmVCbG9n/?p=004d2ec0fcec374c9d6499d9463b2733

Rod · Nov 29, 2017

P.S. I didn't even know Apple had released a patch, shows how far behind I am.

dtravis7 · Nov 29, 2017

Rod thanks for that URL just in case I have that issue.

bertsau · Nov 30, 2017

New security update and fix for root issue in 10.13.1 High Sierra available as of yesterday 2017/11/29

cwa107 · Nov 30, 2017

bertsau said:
New security update and fix for root issue in 10.13.1 High Sierra available as of yesterday 2017/11/29

I think I just heard an echo

Lifeisabeach · Nov 30, 2017

cwa107 said:
I think I just heard an echo

It gets better. I installed the update immediately when I saw it yesterday. This morning, I saw the update was posted AGAIN! I now have "Security Update 2007-001" installed twice. Because this bug is so severe, that patching it twice is the only way to be sure?

pm-r · Nov 30, 2017

Because this bug is so severe, that patching it twice is the only way to be sure?

Or maybe you get one for each of the bugs???

One for the "root login" vulnerability and one to fix the possible "sharing" goof up???

- Patrick
======

macOS High Sierra bug allows Admin access without password

cwa107

Lifeisabeach

Lifeisabeach

cwa107

Lifeisabeach

Raz0rEdge

Well-known member

cwa107

Cr00zng

pm-r

pm-r

Cr00zng

cwa107

dtravis7

Rod

Rod

dtravis7

bertsau

cwa107

Lifeisabeach

pm-r

Shop Amazon