macOS High Sierra's App Store System Preferences Can Be Unlocked With Any Password [Updated]

Discussion in 'MacRumors.com News Discussion' started by MacRumors, Jan 10, 2018.

  1. MacRumors macrumors bot

    MacRumors

    Joined:
    Apr 12, 2001
    #1
    [​IMG]


    A bug report submitted on Open Radar this week has revealed a security flaw in the current version of macOS High Sierra that allows the App Store menu in System Preferences to be unlocked with any password.

    [​IMG]

    MacRumors is able to reproduce the issue on macOS High Sierra version 10.13.2, the latest public release of the operating system, on an administrator-level account by following these steps:

    o Click on System Preferences.
    o Click on App Store.
    o Click on the padlock icon to lock it if necessary.
    o Click on the padlock icon again.
    o Enter your username and any password.
    o Click Unlock.

    As mentioned in the radar, we can confirm that the App Store preferences login prompt does not accept an incorrect password with a non-administrator account, meaning there is no behaviour change for standard user accounts.

    We also weren't able to bypass any other System Preferences login prompts with an incorrect password, with any type of account, so more sensitive settings such as Users & Groups and Security & Privacy are not exposed by this bug.

    Apple has fixed the bug in the latest beta of macOS 10.13.3, which currently remains in testing and will likely be released at some point this month. The bug doesn't exist in macOS Sierra version 10.12.6 or earlier.

    On the current macOS 10.13.2, the bug gives anyone with physical, administrator-level access to a Mac the ability to disable settings related to automatically installing macOS software, security, and app updates.

    This is the second password-related bug to affect macOS High Sierra in as many months, following a major security vulnerability that enabled access to the root superuser account with a blank password on macOS High Sierra version 10.13.1 that Apple fixed with a supplemental security update.

    Following the root password vulnerability, Apple apologized in a statement and added that it was "auditing its development processes to help prevent this from happening again," so this is a rather embarrassing mishap.
    It's worth noting that the App Store preferences are unlocked by default on administrator accounts, and given the settings in this menu aren't overly sensitive, this bug is not nearly as serious as the earlier root vulnerability.

    Apple will likely want to fix this bug sooner rather than later, so it's possible we'll see a similar supplemental update released at some point, or perhaps it will fast track the release of macOS High Sierra version 10.13.3. Apple did not immediately respond to our request for comment on this matter.

    In the meantime, if you keep your App Store preferences behind lock, you'll want to be more diligent in ensuring that you log out of your administrator account when you are away from your Mac. Alternatively, until macOS 10.13.3 is released, users can use a standard account rather than an administrator one.

    While this bug isn't as dangerous as the root password vulnerability, being able to bypass a login prompt with any password is something that obviously shouldn't be possible and is an embarrassing oversight for Apple.

    Article Link: macOS High Sierra's App Store System Preferences Can Be Unlocked With Any Password [Updated]
     
  2. OldSchoolMacGuy macrumors 68040

    OldSchoolMacGuy

    Joined:
    Jul 10, 2008
    #2
    THIS WILL BE THE END OF THE WORLD!

    WHAT HAS HAPPENED TO APPLE LATELY!? IF SOMEONE HAD ACCESS TO MY MACHINE THEY COULD CHANGE A COUPLE FAIRLY MEANINGLESS APP STORE PREFERENCES!!!!
     
  3. Darryl.Jenks macrumors regular

    Darryl.Jenks

    Joined:
    Sep 29, 2014
    Location:
    Self-absorbed
  4. BittenApple macrumors 6502a

    BittenApple

    Joined:
    Nov 29, 2008
  5. thogin macrumors member

    thogin

    Joined:
    Mar 27, 2011
    #5
    I smell another negative Apple news story.. The Verge is gonna love this.
     
  6. techno-Zen macrumors 6502

    Joined:
    Apr 27, 2015
    #6
    Unreal, maybe focus less on retail store trees and more on stuff like this
     
  7. shareef777 macrumors 68020

    shareef777

    Joined:
    Jul 26, 2005
    Location:
    Chicago, IL
  8. Crosscreek macrumors 68030

    Crosscreek

    Joined:
    Nov 19, 2013
    Location:
    Margarittaville
  9. Hustler1337, Jan 10, 2018
    Last edited: Jan 10, 2018

    Hustler1337 macrumors 68000

    Hustler1337

    Joined:
    Dec 23, 2010
    Location:
    London, UK
    #9
    Wow, Apple have become a real mess. They tout themselves as valuing user privacy and security, yet they seem to be the ones handing out the keys themselves!
     
  10. pete2106 macrumors member

    pete2106

    Joined:
    Dec 7, 2012
    #10
    Don't worry guys. I'm on the phone to my lawyer right now. Who wants in on the Class Action goodness?
     
  11. chrfr macrumors 603

    Joined:
    Jul 11, 2009
    #11
    This isn't that major an exposure as a user with an admin account would already have access to this setting with the proper credentials. It's also fixed in the 10.13.3 betas. The preference is also unlocked by default when System Preferences is first opened, so no password at all is needed, by default.
     
  12. macfacts macrumors 68020

    macfacts

    Joined:
    Oct 7, 2012
    Location:
    Cybertron
    #12
    What kind of positive news can come from this?
     
  13. outskirtsofinfinity macrumors member

    outskirtsofinfinity

    Joined:
    Aug 2, 2017
    Location:
    Calgary
    #13
    It's all about fingerprints and face recognition now, remember. Passwords are so yesterday. So, I don't see the problem here. /s
     
  14. ShyDrA macrumors newbie

    ShyDrA

    Joined:
    Apr 24, 2017
    Location:
    Stuttgart, Germany
    #14
    Never stopped watching porn so quickly...
     
  15. Wowereit macrumors 6502a

    Joined:
    Feb 1, 2016
    Location:
    Germany
    #14
    So you'd have to already have some sort of access to the machine to deactivate security updates and then hope nobody notices and wait for exploits coming out for older OS versions that you can exploit, while you already have access to the machine anyway?

    Am I the only one thinking that this issue is not that serious?

    Yes, it does make Apple look completely stupid failing to implement a working password request, but it's not dangerous.
     
  16. Jarman74 macrumors regular

    Jarman74

    Joined:
    Mar 22, 2009
  17. hlfway2anywhere macrumors 65816

    Joined:
    Jul 15, 2006
    #16
    I'm not sure how I feel about having the interior decorators of Apple retail working on operating system security...
     
  18. Chupa Chupa, Jan 10, 2018
    Last edited: Jan 10, 2018

    Chupa Chupa macrumors G5

    Chupa Chupa

    Joined:
    Jul 16, 2002
    #17
    A tad bit disturbing because it's so blatant and Apple has stated security is a feature of its products. These type of basic omissions belie its claims. Feels like Mac OS is becoming Windows with all these security patch updates. Maybe Apple needs to slow down here a bit and get back to basics.
     
  19. DNichter macrumors 603

    DNichter

    Joined:
    Apr 27, 2015
    Location:
    Philadelphia, PA
    #18
    One more reason I chose to leave macOS in 2017. iOS is a much better platform for me moving forward. Has everything I need and a bright future ahead. We need a ground up rework of macOS - based on iOS.
     
  20. chrfr macrumors 603

    Joined:
    Jul 11, 2009
    #19
    No you're not. This just isn't a major issue. My concern is that it's a further indicator of Apple's failure to do proper QA on security related issues in the recent past.
     
  21. mungo2k macrumors member

    Joined:
    Mar 11, 2011
    #20
    Not that big of a deal since it only works on an admin account - if someone malicious already has access to your admin account's desktop, you already have big problems.
     
  22. skippermonkey macrumors member

    Joined:
    Jun 23, 2003
    Location:
    Bath, UK
  23. joshlong5258 macrumors newbie

    joshlong5258

    Joined:
    Jan 10, 2018
    #22
    I can see the sensational headline now. And all the android fanboys having brain aneurysms in the comments.
     
  24. ghsNick macrumors 68030

    ghsNick

    Joined:
    May 25, 2010
  25. JoeInMilwaukee macrumors member

    Joined:
    Apr 7, 2015
    Location:
    Milwaukee, WI
    #24
    In the "good ol' days" of Apple I was always running the latest macOS. For the past several years I've been staying one release behind (I just upgraded to Sierra a couple of weeks ago).
     
  26. Edsel macrumors regular

    Joined:
    Mar 18, 2010
    Location:
    Over There
    #25
    Apple spent $5 Billion on their new campus. How much have they spent on quality control?
     

Share This Page