Poll of the Day > New Apple MacOS (High Sierra) has a glaring security issue, can be hacked easily

(+) Yeah! (+)

https://www.wired.com/story/macos-high-sierra-hack-root/

THERE ARE HACKABLE security flaws in software. And then there are those that don't even require hacking at alljust a knock on the door, and asking to be let in. Apple's macOS High Sierra has the second kind.

On Tuesday, security researchers disclosed a bug that allows anyone a blindingly easy method of breaking that operating system's security protections. Anyone who hits a prompt in High Sierra asking for a username and password before logging into a machine with multiple users, they can simply type "root" as a username, leave the password field blank, click "unlock" twice, and immediately gain full access.

In other words, the bug allows any rogue user that gets the slightest foothold on a target computer to gain the deepest level of access to a computer, known as "root" privileges. Malware designed to exploit the trick could also fully install itself deep within the computer, no password required.

---

Yup

No software is safe. Probably a good thing to keep in mind.
---

Somebody screwed the pooch
---

Huh, that's a devtool that was just left in there.

Fun for everyone at work with it! Good for ya noobs!!!!
---

Remotable, or does it require physical access to the machine?

who just leaves root access like that
---

It's just as easily fixed by setting a root password though, this exploit only works in the default state with the account enabled but no password set (which is pretty slack though).
---

Zangulus posted...

Yellow posted...

Yup

No software is safe. Probably a good thing to keep in mind.

Theres no software is safe and then theres getting root access without a password by pressing a button twice.

Lol

The Tor network was found to have an exploit where if you requested an url that started with file:// (?) it would just use your normal IP address pretty recently.

Software is inherently insecure. That's why I keep all my passwords on a piece of paper. That's also why elections should be done with paper. What's going on under the hood? Who knows.
---

Also worth noting that while this seems extra bad because of how simple it is, to a hacker it doesn't matter if they have to type in root twice or do a buffer overflow exploit.

This is also probably one of the many ways a hacker has to get into administrator mode. It has to be done on top of another hack that actually let's them run code on your machine in the first place.
---