WARNING: Huge Bug Discovered macOS High Sierra, Lets Anyone Log In as Root Without Password

WARNING: Huge Bug Discovered macOS High Sierra, Lets Anyone Log In as Root Without Password

Posted by · 9908 views · Translate
A major bug has been discovered in macOS High Sierra that can allow anyone to log in as root without a password.

The bug was discovered by Lemi Orhan Ergin‏ who tweeted about it this morning:

Dear @AppleSupport, we noticed a *HUGE* security issue at MacOS High Sierra. Anyone can login as "root" with empty password after clicking on login button several times. Are you aware of it @Apple?

The bug has been verified and it is a massive security risk. It appears that an attempt to login as root with no password will enable the root user if it's not already enabled and give you access to the device. It appears to work on macOS 10.13, 10.13.1, and 10.13.2 beta.

To try the bug for yourself:
● Open System Preferences
● Choose Users & Groups from the System Preferences window
● Click the lock at the bottom left of the window
● Enter root as the username and hit enter or click Unlock.

It's believed that the first time you click Unlock the root account is enabled and the second time you click unlock you gain access. However, some users report needing to click a few more times. Others report needing to move the cursor into the password field first.

There have been reports of the bug working in Apple Script, in Installers, from the login window, from a guest account, via shared services login, and more.


[via @patrickwardle]

Until Apple releases a fix, you should enable the root user on your machine and give it a non-blank password. You can find instructions on how to do so below. This will prevent any malicious login attempts.

How to Enable the Root User and Change the Root User Password in macOS High Sierra

Apple says its working on a software update which should be available soon. Please follow iClarified on Twitter, Facebook, Google+, or RSS for updates.


WARNING: Huge Bug Discovered macOS High Sierra, Lets Anyone Log In as Root Without Password
Billy - November 29, 2017 at 5:19pm
Apple already released an update.
D4xM4Nx - November 29, 2017 at 9:23am
It's great that we've got a method to cover ourselves until Apple issues an update. I'm quite the security paranoid, so I enabled the root password feature first time since I got my MBP... Remember to create hard to guess passwords.
Jake Johand - November 29, 2017 at 6:28am
LOL I was heading straight to the crapple store in the morning!
Terry Tollard - November 29, 2017 at 3:30pm
LAWL no one cares Jake the fake.
Steak Stewerd - November 29, 2017 at 3:31pm
*Apple.
4 More Comments
Recent