TromboneChat

Unbelievable oversight or most unhidden backdoor ever?

Anyone Can Hack MacOS High Sierra Just by Typing "Root"

QuoteAnyone who hits a prompt in High Sierra asking for a username and password before logging into a machine with multiple users, they can simply type "root" as a username, leave the password field blank, click "unlock" twice, and immediately gain full access.

In other words, the bug allows any rogue user that gets the slightest foothold on a target computer to gain the deepest level of access to a computer, known as "root" privileges.
Quote...however—and other researchers confirm—that it's possible to block the attack by either setting a password for the root user, or disabling root access altogether. If you've installed High Sierra and haven't set a root password or disabled root access, you should do it now.

Interesting. Mac is an UNIX and that's *sort of* the standard for other UNIX machines. Except when you setup those operating systems, normally you are required to set a password for root and cannot continue unless you set one or go through a mildly tedious process to disable the password. I've never even tried to not set a root password on any machine I've setup but I imagine if you went through the process, you'd end up with a 'null' password, and have the same 'bug' even though it is technically intended in that circumstance.

It's already patched.

Quote from: RabidDolphin on Nov 30, 2017, 02:38PMIt's already patched.

If everyone's done the updates...

sudo passwd root

Quote from: Todd Jonz on Dec 03, 2017, 06:16AMsudo passwd root

Nooooooooooooo.............

sudo is supposed to be a secret reserved for computer high priests.

 

robcat2075 writes:

> Unbelievable oversight or most unhidden backdoor ever?

Apple reached new heights of sheer sloppiness last week.  I suspect there were some personnel changes in Apple's release management group.  Let's review:

1. A bad macOS release goes out allowing anyone to login as root without a password.

2.  Apple releases a patch without adequate testing and unwisely decides to have Software Update install it on customer devices without user intervention.  The patch fixes the root login problem but breaks File Sharing.  Apple develops and releases yet another patch.

3.  A crash loop reported by numerous iOS 11.1.x users does not appear to affect 11.2 beta testers, so Apple decides to rush 12.2 out the door.  The release notes announce the availability of Apple Pay Cash (person-to-person transfers) but it doesn't work because the backend won't be turned on for another week.

Wonder if this applies to Linux as well...

Bruce writes:

> Wonder if this applies to Linux as well.

No.

Another reason for me to stay with El Capitan.

Jerry Walker

Another reason for me to stay with El Capitan.

Jerry Walker