Monday, 11 December, 2017

How to fix the massive macOS root security bug

MacOS High Sierra login bug Apps & Software Image Source Apple
Delores Daniels | 29 November, 2017, 01:08

Without explaining what the actual bug is (we don't want to make it any easier for potential hackers than this already is, and you can find it on Twitter pretty easily), someone can login to a Mac by typing a word in the login field, leaving the password field blank, and attempting to log in several times.

You can expect a macOS 10.13 High Sierra update or security update in the next few days.

There may be other ways that this vulnerability can be exploited: I'll update this post as more information becomes available.

Many people responding to that tweet said they were relieved to learn that this extremely serious oversight by Apple does not appear to be exploitable remotely. To exploit the vulnerability, someone with access to the computer can type "root" and no password in the Users & Groups section of System Preferences. If you do that, High Sierra promptly sets up a new account called System Administrator and a home folder located in /private/var/root.

The level of unbridled access this security hole permits - and it abruptly being made public - will nearly certainly prompt Apple to move fast in releasing an update for its Mac operating system. They can change any users' password, allowing them to log in and access things like email and browser passwords. Then from the menu bar at the top of the screen, click on the "Edit" menu and choose "Enable Root User".

Effectively, this issue renders any system running macOS High Sierra completely unsecured - as it doesn't just unlock the device, it gives Admin access.

Go to System Preferences then click Users & Groups (or Accounts).

Click in the Directory Utility window, then enter an administrator name and password.

You can patch this problem right now by creating a root account manually and giving it a secure password.

Recommended

  • Gophers Volleyball Team is No. 7 Overall Seed in NCAA Tournament

    Gophers Volleyball Team is No. 7 Overall Seed in NCAA Tournament

    The Pioneers' current RPI (55) is the highest end-of-season RPI in program history, which earned them a No. 3 seed in the region. Missouri State lost to Ohio State in Manhattan, Kan., last season, and defeated Arkansas in 2006 for its only tournament victory.
    Trump Ridiculed For Time Magazine Tweet

    Trump Ridiculed For Time Magazine Tweet

    In 2016, Time named Trump its 2016 "Person of the Year" largely due to his feat of emerging the United States president. TIME tweeted, "The President is incorrect about how we choose Person of the Year".
    Sheriff: Suspect in deputy's slaying claimed to be

    Sheriff: Suspect in deputy's slaying claimed to be "God"

    Berak had previous convictions for possession of marijuana and attempting to flee and elude law enforcement. The attorney stated Berak has a history of mental health issues and is now seeing a psychiatrist.
  • First Lady Melania Trump unveils Christmas decorations at the White House

    First Lady Melania Trump unveils Christmas decorations at the White House

    She is the one who pushed him to run just by saying run or do not run [but] I don't think she was ever too insane about it". But this year, Donald Trump fulfilled a campaign promise of sorts with his card.
    Meghan Markle Says She's Leaving Acting To Focus On Royal Duties

    Meghan Markle Says She's Leaving Acting To Focus On Royal Duties

    Markle called The Duchess of Cambridge out as being "absolutely amazing" to her during her first interview with Harry yesterday. St George's Chapel at Windsor Castle.
    1 defends Hong Kong Open badminton title

    1 defends Hong Kong Open badminton title

    The Thai constructed another post with an angled shot to draw Sindhu near the court and then produced a victor on her backhand. Deceptive net returns and backhand smashes, coupled with unforced errors from Sindhu, allowed the Taiwanese to lead 18-14.
  • Manchester United striker Romelu Lukaku avoids Premier League suspension

    Manchester United striker Romelu Lukaku avoids Premier League suspension

    I am happy with the attitude of a team that didn't play well and the attitude of a team that didn't play well is important. The incident happened during the corner which led to Ashley Young's deflected victor at Old Trafford last Saturday.
    AAA: Michigan average gas price drops 10 cents after Thanksgiving

    AAA: Michigan average gas price drops 10 cents after Thanksgiving

    Californias average of $3.191 is 52 cents higher than a year ago, with 12 cents of that due to a state tax increase last month. AAA Michigan surveys daily fuel prices at 2,800 gas stations across the state.
    Derrick Rose Leaves Cavs, Unsure Whether He'll Keep Playing

    Derrick Rose Leaves Cavs, Unsure Whether He'll Keep Playing

    Rose signed a veteran's minimum deal with the Cavaliers as a free agent this summer after playing for the Knicks last season. According to ESPN , Rose has not communicating with people close to him inside the Cavs organization in the last few days.
  • Christmas tree farmers expect to sell more this year

    Christmas tree farmers expect to sell more this year

    According to the National Christmas Tree Association , the 2008 recession is still affecting tree farms across the US today. Here are some tips for getting that "perfect" tree or at least your version of what the flawless tree looks like.
    Meredith to buy Time for $3.8b in all-cash transaction

    Meredith to buy Time for $3.8b in all-cash transaction

    Then earlier this month, the New York Times reported that talks were back on after Charles G. and David H. Time has been reeling under the same pressures facing the rest of the magazine industry.
    Klopp fury after Chelsea leveller

    Klopp fury after Chelsea leveller

    Jurgen Klopp has insisted that he is not focused on catching Premier League leaders Manchester City at the top of the table.

Here is a latest rule of Supreme Court on 'Padmavati' Here is a latest rule of Supreme Court on 'Padmavati' According to the latest reports, the studio Viacom 18 has made a decision to release the film on Republic Day weekend keeping the whole holiday weekend in mind.

Russian jet intercepts United States aircraft over Black Sea Russian jet intercepts United States  aircraft over Black Sea United States officials have accused the Russian pilot of acting in an "unsafe" manner by crossing in front of the Navy P-8. P-8A Poseidon, disrupting the routine practice of intercepting non-ally aircraft near national waters.

Missing Argentina Submarine Carried More than its Capacity Missing Argentina Submarine Carried More than its Capacity Argentina's navy insisted the ARA San Juan submarine was in good condition before it set off on its mission. The submarine was sailing from the extreme southern port of Ushuaia to the coastal city of Mar del Plata.

Pharma leader MSD endorses government's Industrial Strategy Pharma leader MSD endorses government's Industrial Strategy And German diagnostics expert Qiagen will spend billions on a campus in Manchester to lead work on genomics, creating 800 jobs. This could mean an extra £80bn investment in advanced technology, according to government estimates.

Unlocked HTC U11 to get Android 8.0 Oreo update today Unlocked HTC U11 to get Android 8.0 Oreo update today The smartphone was shipped with Android 7.1 in the USA market, which left users anticipating the update for Android 8.0 Oreo. HTC's Vice President of Product Management Mo Versi announced the news via his Twitter handle in the midst of Thanksgiving.

Wenger: late victor a clear penalty Wenger: late victor  a clear penalty Arsene Wenger believes Arsenal will proceed with a renewed sense of confidence following their late 1-0 victory at Burnley . We look forward to going there and getting another one this season, making it four.

Amazon Launches Sumerian Tool For Building Immersive AR, VR And 3D Apps Amazon Launches Sumerian Tool For Building Immersive AR, VR And 3D Apps The Sumerian service includes an object library with 3D models along with assistance for importing assets from FBX and OBJ files. Amazon Web Services doesn't charge a fee for designing and editing AR and VR applications.

Man City make Premier League history with Huddersfield win Man City make Premier League history with Huddersfield win We need to win these kinds of games in this way because maybe we convince more that we're able to, but whatever. So, the gaps are nearly impossible but we found them, most of the time, and that's why I'm so, so pleased.

Trump Calls Doug Jones a 'Schumer/Pelosi Puppet' Trump Calls Doug Jones a 'Schumer/Pelosi Puppet' Trump, who has said all of his accusers lied, declined to answer Tuesday when asked why he does not believe Moore's accusers. Moore has been accused by several women of pursuing relationships with them when they were teenagers and he was a grown man.

After President Trump Slams CNN, James Comey Posts "Freedom of Press" After President Trump Slams CNN, James Comey Posts In a lengthy tweet, Mr Trump on Sunday alleged that CNN represents United States to the world very poorly. Their reporting prompted the United Nations to open an investigation into the matter.

Schiano to be named Tennessee Vols Head Coach Schiano to be named Tennessee Vols Head Coach Schiano developed a relationship with Currie when he was out of coaching for two seasons following his short tenure in Tampa. Schiano later told ESPN, "I never saw any abuse nor had reason to suspect any abuse during my time at Penn State".

Oakland Raiders WR Michael Crabtree, Denver Broncos' Aqib Talib ejected after fight Oakland Raiders WR Michael Crabtree, Denver Broncos' Aqib Talib ejected after fight Oakland added another touchdown on a 1-yard run by Marshawn Lynch with 2:49 remaining in the first half. Crabtree and Talib were both ejected for their role in the fight , as was Raiders guard Gabe Jackson .

UCLA Hires Chip Kelly As Head Football Coach UCLA Hires Chip Kelly As Head Football Coach Kelly, the 17th head coach in the school's history, is expected to be introduced to the public at UCLA on Monday. Prior to that, he spent three seasons with the Eagles and went 26-21.

Tom Baker returns to Doctor Who to complete 'lost' episode Tom Baker returns to Doctor Who to complete 'lost' episode The original episode was scrapped after a BBC strike, but not before seven hours of filming for the show had been completed. Shada is now available to buy as a digital download and is set for release on DVD and Blu-ray on 4 December.

See What Nigerians Did To Atiku Abubakar After His Defection From APC See What Nigerians Did To Atiku Abubakar After His Defection From APC The PDP national publicity secretary, Prince Dayo Adeyeye, told newsmen at a press conference yesterday in Abuja that the plot was aimed at creating division and rubbishing the party.