June 28, 2022
WARNING: Huge Bug Discovered macOS High Sierra, Lets Anyone Log In as Root Without Password

WARNING: Huge Bug Discovered macOS High Sierra, Lets Anyone Log In as Root Without Password

Posted November 29, 2017 at 2:01am by iClarified · 16980 views
A major bug has been discovered in macOS High Sierra that can allow anyone to log in as root without a password.

The bug was discovered by Lemi Orhan Ergin‏ who tweeted about it this morning:

Dear @AppleSupport, we noticed a *HUGE* security issue at MacOS High Sierra. Anyone can login as "root" with empty password after clicking on login button several times. Are you aware of it @Apple?

The bug has been verified and it is a massive security risk. It appears that an attempt to login as root with no password will enable the root user if it's not already enabled and give you access to the device. It appears to work on macOS 10.13, 10.13.1, and 10.13.2 beta.

To try the bug for yourself:
● Open System Preferences
● Choose Users & Groups from the System Preferences window
● Click the lock at the bottom left of the window
● Enter root as the username and hit enter or click Unlock.

It's believed that the first time you click Unlock the root account is enabled and the second time you click unlock you gain access. However, some users report needing to click a few more times. Others report needing to move the cursor into the password field first.

There have been reports of the bug working in Apple Script, in Installers, from the login window, from a guest account, via shared services login, and more.

[via @patrickwardle]

Until Apple releases a fix, you should enable the root user on your machine and give it a non-blank password. You can find instructions on how to do so below. This will prevent any malicious login attempts.

How to Enable the Root User and Change the Root User Password in macOS High Sierra

Apple says its working on a software update which should be available soon. Please follow iClarified on Twitter, Facebook, Google+, or RSS for updates.

WARNING: Huge Bug Discovered macOS High Sierra, Lets Anyone Log In as Root Without Password
Add Comment
Would you like to be notified when someone replies or adds a new comment?
Yes (All Threads)
Yes (This Thread Only)
iClarified Icon
Would you like to be notified when we post a new Apple news article or tutorial?
You must login or register to add a comment...
Billy - November 29, 2017 at 5:19pm
Apple already released an update.
D4xM4Nx - November 29, 2017 at 9:23am
It's great that we've got a method to cover ourselves until Apple issues an update. I'm quite the security paranoid, so I enabled the root password feature first time since I got my MBP... Remember to create hard to guess passwords.
Jake Johand
Jake Johand - November 29, 2017 at 6:28am
LOL I was heading straight to the crapple store in the morning!
Terry Tollard
Terry Tollard - November 29, 2017 at 3:30pm
LAWL no one cares Jake the fake.
Steak Stewerd
Steak Stewerd - November 29, 2017 at 3:31pm
4 More Comments
Recent. Read the latest Apple News.
Tutorials. Help is here.
iPhone 13 Pro Repair Manual PDF [Download]
How to Add Widgets on iPhone [Video]
iPhone 13 Repair Manual PDF [Download]
iPhone 13 Pro Max Repair Manual PDF [Download]
Where to Download macOS Monterey
Deals. Save on Apple devices and accessories.