[UNPATCHED] Major Apple security flaw grants admin access on macOS High Sierra without password

[captain_to_fire]

Just now, Ryan_Vickers said:

That's really weird that it can even be disabled

Darwin which is used by Apple is also based on UNIX are open source operating systems. It is the basis of OS X/macOS and they can do whatever they want to the code.

[vanished]

Just now, hey_yo_ said:

Darwin which is used by Apple is also based on UNIX are open source operating systems. It is the basis of OS X/macOS and they can do whatever they want to the code.

I'm not questioning their right to be able to modify it, I'm questioning the technical possibility.  It's just interesting to me

[Trixanity]

12 hours ago, Ryan_Vickers said:

 

Really guys? c'mon...

 

What does this even mean?

[Blade of Grass]

On 2017-11-29 at 4:44 AM, Trixanity said:

Stupid vulnerability but it seems kinda familiar. Didn't Linux have something similar some months back? Something with repeating a certain action like 17 times giving full access? Although it does seem like in Apple's case it was almost intentional.

 

Also, is the root 'account' always enabled? If I recall on Windows you need to enable it yourself and on Linux you're prompted/supposed to change the root password.

root is not always enabled, it's by default disabled. 

On 2017-11-29 at 8:12 AM, FPSwithaWacomTablet said:

Or do what Ubuntu is already doing and set the password during installation/setup?

 

Kinda creeps me out that some UNIX-based OSes don't use features Linux takes for granted.

Ubuntu also gives you the option to leave root disabled and use sudo--exactly what MacOS does.

22 hours ago, Ryan_Vickers said:

Wait wait wait... Lets get something completely clear here, what is the nature of this exploit?

 

My understanding was that, regardless of the password set, you could login without providing it by clicking the button a few times.

Are you saying that this actually only happens if you don't have a password set?  Because that completely changes things...

If that's the case, the bug isn't that it lets you in after 3 tries, it's that it didn't let you in after the first try   It's fairly obvious that if prompted for a password when there is no password/the password is blank, the correct response to clicking "login" would be to do so.

Granted, there's a separate issue here that it should not allow the root password to be blank, at least not without warning you about the possible consequences thoroughly first, but yeah... what is the real story here?  I never got the impression from OP that this only worked if the password was already left blank.  If that is the case, it would also make the first reply from Apple suddenly make sense.

16 hours ago, hey_yo_ said:

Most people don't set a root password. Root access is disabled by default on Mac OS X since Snow Leopard (I'm not sure), it appears that root access is enabled by default on macOS High Sierra. Here's Apple's whitepaper for Mac OS X Snow Leopard: https://web.archive.org/web/20110410065128/http://images.apple.com:80/macosx/security/docs/MacOSX_Security_TB.pdf

Perhaps Apple accidentally or deliberately enabled root access by default. Good thing Apple just issued a software update today.

My understanding is that root is disabled by default and the first attempt actually enables the root account, but since the account has no password, on the second attempt you can login with no password. 

[vanished]

1 hour ago, Blade of Grass said:

My understanding is that root is disabled by default and the first attempt actually enables the root account, but since the account has no password, on the second attempt you can login with no password. 

Ah, I see, yeah that's not a great way to have it work Good thing it's fixed.

7 hours ago, VegetableStu said:

video/gif is fake

yes

[79wjd]

Apple, you're just trolling now, right? right???

 

If you downloaded the patch while on 10.13.0 and then upgraded to 10.13.1, then the patch has been removed. @SC2Mitch

https://9to5mac.com/2017/12/02/macos-10-13-1-root-hole-bug/

[ItsMitch]

LMAO, it's like apple don't care, 

Just now, djdwosk97 said:

Apple, you're just trolling now, right? right???

 

If you downloaded the patch while on 10.13.0 and then upgraded to 10.13.1, then the patch has been removed. @SC2Mitch

https://9to5mac.com/2017/12/02/macos-10-13-1-root-hole-bug/

Updated

[DrMacintosh]

On 11/28/2017 at 1:00 PM, SC2Mitch said:

PSA: Upgrading to macOS 10.13.1 will undo Apple’s patch for critical root vulnerability

Uhh not it won't. 

 

You should have been on 10.13.1 already when the security hole was patched. 

[79wjd]

1 minute ago, DrMacintosh said:

Uhh not it won't. 

 

You should have been on 10.13.1 already when the security hole was patched. 

*cough* https://9to5mac.com/2017/12/02/macos-10-13-1-root-hole-bug/ *cough*

 

If you were on 10.13.0 when you installed the patch then it will be undone when you update to 10.13.1.

[DrMacintosh]

Just now, djdwosk97 said:

*cough* https://9to5mac.com/2017/12/02/macos-10-13-1-root-hole-bug/ *cough*

Like I said. If you were on 10.13.1 nothing would happen. 

[79wjd]

Just now, DrMacintosh said:

Like I said. If you were on 10.13.1 nothing would happen. 

And if you weren't, then it gets undone when you update. Which is exactly what was said. 

[DrMacintosh]

1 minute ago, djdwosk97 said:

And if you weren't, then it gets undone when you update. Which is exactly what was said. 

But you should have been on 10.3.1 anyway.......

 

The damn thing was out a month before this. 

[79wjd]

1 minute ago, DrMacintosh said:

But you should have been on 10.3.1 anyway.......

 

The damn thing was out a month before this. 

And yet there's at least one person who was on 10.13.0 -- the person who posted the article. Not everyone updates frequently -- that was one of the major reasons behind Microsoft making updates in W10 mandatory. 

[DrMacintosh]

Just now, djdwosk97 said:

Not everyone updates frequently. 

That's on them. 

 

And unless they want Apple to start doing forced updates those people are going to have to deal with it. 

[79wjd]

1 minute ago, DrMacintosh said:

That's on them. 

Right, Apple isn't to blame at all for not updating the 10.13.1 update to include the patch. Nope. 100% the consumers fault if they choose to update after installing the patch. 

[DrMacintosh]

Just now, djdwosk97 said:

Right, Apple isn't to blame at all for not updating the 10.13.1 update to include the patch. Nope. 100% the consumers fault if they choose to update after installing the patch. 

It really is. 

 

OS version X is not patched--> becomes patches--> updates to a version that was out before this issue was found--> OS is no longer patched. 

 

It's easy really. 

[79wjd]

Just now, DrMacintosh said:

It really is. 

 

OS version X is not patched--> becomes patches--> updates to a version that was out before this issue was found--> OS is no longer patched. 

 

It's easy really. 

And Apple knew 10.13.1 was also not patched, so they could easily have appended the patch onto the 10.13.1 update. But no, they didn't; they overlooked it; they fucked up. 

[DrMacintosh]

1 minute ago, djdwosk97 said:

And Apple knew 10.13.1 was also not patched, so they could easily have appended the patch onto the 10.13.1 update. But no, they didn't; they overlooked it; they fucked up. 

pull the update and resend it to everyone who has it and ask them to update to 10.13.1 again.....

 

OR

 

Send out the security patch.......

 

The second option sound the simplest too me in the interest of time. 

[Sauron]

13 minutes ago, DrMacintosh said:

Uhh not it won't. 

 

You should have been on 10.13.1 already when the security hole was patched. 

 

5 minutes ago, DrMacintosh said:

It really is. 

 

OS version X is not patched--> becomes patches--> updates to a version that was out before this issue was found--> OS is no longer patched. 

 

It's easy really. 

As if they didn't have full control on what updates are pushed to your machine...? All they needed to do was bundle the patch with the update for everyone downloading it after the issue was fixed.

[79wjd]

3 minutes ago, DrMacintosh said:

pull the update and resend it to everyone who has it and ask them to update to 10.13.1 again.....

 

OR

 

Send out the security patch.......

 

The second option sound the simplest too me in the interest of time. 

Or, and here's just a wild thought....

 

Push out the security patch to anyone on 10.13.0 and 10.13.1. Then anyone who chooses to install the 10.13.1 update will also have the patch pushed after the update is complete. It's really not hard, but that's not what they did. They didn't think to automatically push the patch to anyone who updates to 10.13.1. 

[DrMacintosh]

1 minute ago, Sauron said:

All they needed to do was bundle the patch with the update for everyone downloading it after the issue was fixed.

Or just send one patch for everyone. 

 

Those on 10.13.1 just need to install the patch rather than the whole OS version again and those on 10.13.0 need to update to 10.13.1 then install the patch. 

 

Sounds easy to me. 

[79wjd]

1 minute ago, DrMacintosh said:

Or just send one patch for everyone. 

 

Those on 10.13.1 just need to install the patch rather than the whole OS version again and those on 10.13.0 need to update to 10.13.1 then install the patch. 

 

Sounds easy to me. 

No one said anything about them requiring you to reinstall the 10.13.1 update. I'll type in big capital letters so maybe you'll understand.

 

BUNDLE THE PATCH ONTO THE 10.13.1 UPDATE FOR ANYONE WHO WAS ON 10.13.0 BUT ALSO INCLUDE IT AS A STANDALONE PATCH.

[DrMacintosh]

1 minute ago, djdwosk97 said:

Push out the security patch to anyone on 10.13.0 and 10.13.1. Then anyone who chooses to install the 10.13.1 update will also have the patch pushed after the update is complete.

That is exactly what happened. 

[79wjd]

Just now, DrMacintosh said:

That is exactly what happened. 

No. What happened is they pushed the patch out to all users. If you're on 10.13.1, then you're patched and good. If you were on 10.13.0 and patched then you were good until you chose to upgrade to 10.13.1, then you're vulnerable again. There is no reason why the patch shouldn't have also been bundled to the 10.13.1 update.

[DrMacintosh]

1 minute ago, djdwosk97 said:

No one said anything about them requiring you to reinstall the 10.13.1 update.

Yes you did. By saying you should include it with 10.13.1 that means everyone already on 10.13.1 would see an update for their machines. 

 

The solution was what Apple did. 

 

Give the update to everyone on 10.13.0 and 10.13.1. If they update to 10.13.1 from 10.13.0 after getting the patch send them the patch again.