July 23, 2024
WARNING: Huge Bug Discovered macOS High Sierra, Lets Anyone Log In as Root Without Password

WARNING: Huge Bug Discovered macOS High Sierra, Lets Anyone Log In as Root Without Password

Posted November 29, 2017 at 2:01am by iClarified
A major bug has been discovered in macOS High Sierra that can allow anyone to log in as root without a password.

The bug was discovered by Lemi Orhan Ergin‏ who tweeted about it this morning:

Dear @AppleSupport, we noticed a *HUGE* security issue at MacOS High Sierra. Anyone can login as "root" with empty password after clicking on login button several times. Are you aware of it @Apple?

The bug has been verified and it is a massive security risk. It appears that an attempt to login as root with no password will enable the root user if it's not already enabled and give you access to the device. It appears to work on macOS 10.13, 10.13.1, and 10.13.2 beta.

To try the bug for yourself:
● Open System Preferences
● Choose Users & Groups from the System Preferences window
● Click the lock at the bottom left of the window
● Enter root as the username and hit enter or click Unlock.

It's believed that the first time you click Unlock the root account is enabled and the second time you click unlock you gain access. However, some users report needing to click a few more times. Others report needing to move the cursor into the password field first.

There have been reports of the bug working in Apple Script, in Installers, from the login window, from a guest account, via shared services login, and more.

[via @patrickwardle]

Until Apple releases a fix, you should enable the root user on your machine and give it a non-blank password. You can find instructions on how to do so below. This will prevent any malicious login attempts.

How to Enable the Root User and Change the Root User Password in macOS High Sierra

Apple says its working on a software update which should be available soon. Please follow iClarified on Twitter, Facebook, or RSS for updates.

WARNING: Huge Bug Discovered macOS High Sierra, Lets Anyone Log In as Root Without Password
Add Comment
Would you like to be notified when someone replies or adds a new comment?
Yes (All Threads)
Yes (This Thread Only)
iClarified Icon
Would you like to be notified when we post a new Apple news article or tutorial?
Comments (7)
You must login or register to add a comment...
Billy - November 29, 2017 at 5:19pm
Apple already released an update.
D4xM4Nx - November 29, 2017 at 9:23am
It's great that we've got a method to cover ourselves until Apple issues an update. I'm quite the security paranoid, so I enabled the root password feature first time since I got my MBP... Remember to create hard to guess passwords.
Jake Johand
Jake Johand - November 29, 2017 at 6:28am
LOL I was heading straight to the crapple store in the morning!
gamerscul9870 - November 29, 2017 at 3:31pm
boom bomm
boom bomm - November 29, 2017 at 6:05am
freakin awesome
Jon Zubin
Jon Zubin - November 29, 2017 at 2:25am
Root with Blank password reminds me of early Unix running on a PDP 11-45 in the early seventies
gamerscul9870 - November 29, 2017 at 2:11am
Time to download stuff on the macs at Best Buy using this while it lasts. Now people can't be restricted by the administrator password until this is fixed.
Recent. Read the latest Apple News.
Tutorials. Help is here.
Where to Download macOS Monterey
Where to Download macOS Ventura
AppleTV Firmware Download Locations
Where To Download iPad Firmware Files From
Where To Download iPhone Firmware Files From
Deals. Save on Apple devices and accessories.