Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Major macOS High Sierra Bug Allows Full Admin Access Without Password - How to Fix [Updated]

JustSomeHuman said:
It doesn't work for me after a dozen tries both in login and Users & Groups, both clicking immediately or waiting for 30 seconds or so. But see my post below.
Click to expand...

You need to use the return key, not the Unlock button for the bug to manifest itself. Latest High Sierra beta released today is still vulnerable. Having root disabled/no password is the only other requirement besides hitting return with root:blank once or twice.
 
Ridiculously stupid. Reminds me of how I got into my locked Win98 laptop by clicking help, trying to print the help, choosing a print border, then opening the admin user's desktop to browse for the print border. Except that was in 1998.
 
MacOS is one of the few mature products among Apple’s current offerings. I always considered it rock solid and reliable. When a new OSX version was released, I didn’t hesitate to upgrade. Given the company’s current ambitions and priorities, I postponed upgrading to High Sierra. Despite the public beta program, I don’t have the same faith in Apple's execution and quality control. Seems their software is a constant work-in-progress. One wonders how they managed to deliver an OS without beta testers before—and on discs!

Perhaps OS’s are reaching their limitations. Perhaps no OS or programming schema is capable of being the futuristic multi-tasker that we imagine; perhaps computers are not the Holy Grail after all.
 
Defthand said:
MacOS is one of the few mature products among Apple’s current offerings. I always considered it rock solid and reliable. When a new OSX version was released, I didn’t hesitate to upgrade. Given the company’s current ambitions and priorities, I postponed upgrading to High Sierra. Despite the public beta program, I don’t have the same faith in Apple's execution and quality control. Seems their software is a constant work-in-progress. One wonders how they managed to deliver an OS without beta testers before—and on discs!

Perhaps OS’s are reaching their limitations. Perhaps no OS or programming schema is capable of being the futuristic multi-tasker that we imagine; perhaps computers are not the Holy Grail after all.
Click to expand...
I never update until either Xcode absolutely stops working on the old OS or there's a serious security bug in the old one. So I'm always on the most mature minor version. Can't trust Apple anymore.
 
bobbykjack said:
Looks like we have a new 'wait at least this long before upgrading' guideline: at least two months.
Click to expand...

I fear these occurrences will become even more frequent. IMO, it's from moving toward one OS for all devices. Say, "Apple OS?" The focus is being lost on the core security priorities of the OS. Too much emphasis on bells, and whistles. Plus the move to APFS is not helping.
iOS 11 clearly is the worst iOS roll out ever. Again a lack of focus on core requirements due to more bells and whistles. Just look at all who shelled out $1,100-1,500 for Animojis. Hairforce one needs to have a serious gut check. :apple:
 
  • Like
Reactions: nt5672, kazmac, bobbykjack and 1 other person
ke-iron said:
True things have change however we need to keep in mind Apple is innovating at a much faster pace than before. New hardware and OSes are released every year. In the past is wasn’t as frequent and I believe this allowed them to really focus on development more thoroughly.
Click to expand...
I agree, but when it comes down to Security flaws like this there can not be any excuse. Cybercrime is everywhere, you must be able to trust your machine!
 
  • Like
Reactions: arkitect
Worked for me if I clicked the password field, then the unlock button, but if I tabbed to the password field, and then clicked unlock it didn't work. So a bit wonky.
[doublepost=1511908303][/doublepost]
davcolley said:
Does this exploit work if the main drive is encrypted?
Click to expand...

Yes, my drive is encrypted and I was able to reproduce.
 
Unfortunately setting a root password can break things, and cause strange issues. Once you do it, it's a reinstall to fix.

The better option is to power off the machine when leaving it. Hello 1991.
 
MallardDuck said:
Unfortunately setting a root password can break things, and cause strange issues. Once you do it, it's a reinstall to fix.
Click to expand...

Better solution is just don't leave your mac unlocked. So then they have to get your password to get to the screen to add themselves an account.
 
Oh look another reason to stay on Sierra! I would love to know why Apple are so desperate to push out new software without even having a bit of breathing space from the last one! Apples line ‘upgrading to High Sierra is for security and compatibility reasons’ cobblers!
 
Defthand said:
I don’t have the same faith in Apple's execution and quality control. Seems their software is a constant work-in-progress. One wonders how they managed to deliver an OS without beta testers before—and on discs!
.
Click to expand...

Perhaps you just didn't realize that there are exploits every year and you were never as safe as you imagined.

10.3 and 10.4 could be rooted with bluetooth
http://tidbits.com/article/8729

10.5 and 10.6 had some nice rootkits
https://www.macrumors.com/2017/07/27/vault-7-wikileaks-older-macs/

10.7 through 10.10 were vulnerable to root pipe
https://www.exploit-db.com/exploits/36692/

10.11 had a SIP flaw
https://thehackernews.com/2016/03/system-integrity-protection.html
 
  • Like
Reactions: tooltalk and BlueBook
zaphon said:
Better solution is just don't leave your mac unlocked. So then they have to get your password to get to the screen to add themselves an account.
Click to expand...
There are shared environments like schools where this isn't an option. But yeah, for a single user, root doesn't mean much. All the real damage can be done on my own user.
 
bbfc said:
Doesn't work for me. Can't replicate. Tried numerous times. Keeps asking for my password.
Click to expand...

Yeah, I'm not vulnerable either. I may have set a root password many years ago when there was another vulnerability for which doing so was the recommended solution.
 
zaphon said:
Better solution is just don't leave your mac unlocked. So then they have to get your password to get to the screen to add themselves an account.
Click to expand...

Won't help. All they need to do is to click on "Switch user" in the lock screen, select Other, and input root as the user and leave the password blank.
 
  • Like
Reactions: MacBird
JLL said:
Or open /System/Library/CoreServices/Applications/Directory Utility

Disable the root user in the Edit menu.
Click to expand...

Doing a password-less root login after disabling the root user will automatically re-enable them again.

Alternatively, setting a password for the root user, then disabling the root user, and then using a password-less root login will re-enable the root user with no password again.

If you set a password for root user and leave it enabled, it does fix the problem, however now you have an additional possible threat vector into your system by having root active (even if it does have a password).

This is some major ****ery Apple, what the ever living hell.
 
  • Like
Reactions: DeepIn2U and Roadstar
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back