User Tweets significant security issue with macOS High Sierra to Apple Support

29 November, 2017, 01:09 | Author: Patty Aguilar
  • APPLEmacOS High sierra root bug- how to fix this flaw

Earlier today, a Turkish security developer discovered that macOS High Sierra has the biggest possible security flaw: a root account, enabled by default with no password, that anyone with physical access to your machine can log into. All someone needs to do is change "username" to "root", leave the password blank, and press the "unlock" button multiple times.

The bug was reported by Lemi Orhan Ergin who reached out to Apple over Twitter. It also allows for anyone to login to a machine even immediately after reboot.

This is a critical bug that allows anyone on a Mac to log in and change the admin settings - using just the username "root" with no password. But given the cartoonish extremity of this bug, chances are a fix will be available soon. If you do that, High Sierra promptly sets up a new account called System Administrator and a home folder located in /private/var/root. This is a level of access that is well in excess of a normal admin account that is created when adding users on a Mac. Engadget has confirmed that you can gain root access in the login screen, the System Preferences Users & Groups tab and File Vault with this method. You can see how to exploit works in the video below.

For now, you can test your Mac by going to System Preferences, choosing Users & Groups then click the lock to make changes. Users can prevent an attacker from exploiting a bug by creating a "root" account themselves and giving it a custom password. Click "Login Options", then click "Join", which appears next to the text "Network Account Server".

Apple Mac Book 2017 review
EXPRESS NEWSPAPERS

Currently, there is no official fix from Apple regarding the issue.

After clicking unlock several times, it should eventually open up, no passwords necessary.

Click the lock icon in Directory Utility's window and authenticate.


Recommended:

  • Gophers to host North Dakota in NCAA tournament

    Gophers to host North Dakota in NCAA tournament

    This will mark the second time WKU stays within Kentucky's borders - the team lost 3-1 to No. 9 Louisville in Louisville in 2005. Last year, the Bears played their first two rounds at UCLA, where they upset San Diego in five sets before being swept by UCLA .
    Tyronn Lue expects Derrick Rose to rejoin Cavaliers at some point

    Tyronn Lue expects Derrick Rose to rejoin Cavaliers at some point

    Rose has reportedly been uncommunicative with people around the organization over the past several days. He was placed in a walking boot last week when the ankle wasn't deemed to be healing sufficiently.
    Tennessee fans react negatively to Greg Schiano

    Tennessee fans react negatively to Greg Schiano

    Schiano developed a relationship with Currie when he was out of coaching for two seasons following his short tenure in Tampa. Schiano was hired by the Buccaneers following the 2011 season, but he was sacked after two seasons with an 11-21 record.
  • Jose Mourinho Admits Worries Over Future of Marouane Fellaini

    Jose Mourinho Admits Worries Over Future of Marouane Fellaini

    Sometimes to play with too many attacking players doesn't mean you are offensive. "So I don't know what you want". Pogba also played 70 minutes against Newcastle United last weekend and 66 minutes in Basel four days ago.
    Halftime Report: Buccaneers vs. Falcons

    Halftime Report: Buccaneers vs. Falcons

    He entered the game needing 107 receiving yards to break the league record for the most in the first 90 games of a career. The Buccaneers defense is going to have nightmares about Jones until they face the Falcons again on December 18.
    Uttar Pradesh Train Derailment Updates: 3 People Dead 9 Injured

    Uttar Pradesh Train Derailment Updates: 3 People Dead 9 Injured

    News agency PTI said that the local police had ascertained the identity of two of the three passengers who died in the accident. The three who died were in a sleeper coach. "My honest condolences to the families of the deceased", Mr Goyal said in a tweet.
  • BBB Offers Tips For Donating For Giving Tuesday

    BBB Offers Tips For Donating For Giving Tuesday

    BBB also says to watch out for name similarity of charities to avoid mistaken identity and giving to the wrong fund. The first Giving Tuesday was held in 2012, and a year ago , people gave more than $168 million in donations.
    Dan Mullen Targeted By Gators

    Dan Mullen Targeted By Gators

    Dan Mullen arrived in Gainesville wearing his national championship ring from 2008, when he was Gators' offensive coordinator. Mullen's hiring Sunday ended a four-week process to replace Jim McElwain that left Gator Nation drained of energy.
    Wizards PG Wall out 2 weeks

    Wizards PG Wall out 2 weeks

    He's been dealing with discomfort and swelling since banging knees with another player in a November 7 game against the Mavericks. If he's been playing this well through injury, there's a real possibility he sees a bump when he comes back healthy.
  • The rhetoric is fine but why is this industrial strategy so underwhelming?

    The rhetoric is fine but why is this industrial strategy so underwhelming?

    The first of these challenges is to "put the United Kingdom at the forefront of the artificial intelligence and data revolution". Clean growth - we will maximise the advantages for United Kingdom industry from the global shift to clean growth .
    Amazon's Sumerian Tool Can Be Used To Develop AR And VR Experiences

    Amazon's Sumerian Tool Can Be Used To Develop AR And VR Experiences

    However, customers are afraid of the up-front investment and specialized tools needed to craft useful VR or AR apps. Content built with Sumerian can be deployed to any browser supporting WebGL or WebVR graphics rendering.
    Aqib Talib Talks Fight with Michael Crabtree, Potential Suspension or Fine

    Aqib Talib Talks Fight with Michael Crabtree, Potential Suspension or Fine

    Talib has since come forth to explain his side of the story, saying all he did is come out " to play football on Sunday ". On Monday, Talib was asked about the brouhaha, and he placed the blame directly on Crabtree's shoulders.


Popular

Black Friday Physical Store Sales Turn Out Better Than Expected
Sears Holdings Corp. saw same-store sales fall 17 percent at its flagship chain last quarter and 13 percent at its Kmart brand.

Meghan Markle has met Prince George and Princess Charlotte at Kensington Palace
The palace confirmed that the Queen has given her permission for her grandson to marry at the Chapel, where Harry was baptised. However, she had nothing but fantastic things to say about Meghan in an interview with the Evening Standard in October.

Gas prices have fallen 40 cents in the last three weeks
AAA found self-serve, regular gasoline selling for as low as $2.43 per gallon and as high as $2.70 in Rhode Island. The national average has gone up 37.6 cents since a year ago and is also up 3.5 cents since last month.

Vladimir Putin Signs Bill Targeting International Media Outlets
USA intelligence officials have accused the Kremlin of using Russian media sources to interfere in the presidential election. Putin signed the bill into law Saturday after the upper chamber of the Russian parliament adopted it Wednesday.

Jennifer Lawrence Wants to Quit Acting to Start New Career
The Oscar-winning actress had spilled the beans about dating the 48-year-old director in her September Vogue cover issue. I want to be, like, milking goats, ' the star explained when asked what she has in store for the future.

Jurgen Klopp Not Intrested In Catching Premier League Leaders Manchester City
Gary Cahill went on to say that the Blues were deserving of the draw and disappointed that they couldn't get all three points. Chelsea captain Gary Cahill said the result would please Premier League leaders Manchester City.

SC's Tim Scott to embroiled GOP candidate Roy Moore: 'Move on'
Jack Williams, "there was talk that if Moore fell short maybe he'd run for governor". The following day, he advised that he'd spoken to Moore for the first time.

Michael Crabtree, Aqib Talib ejected for throwing punches during brawl
Chris Harris Jr . had a confrontation with Crabtree during a previous play in which he claimed to be punched in the groin area. Raiders players began pushing the Denver players circled around Crabtree, leading to a brawl between the teams.

Patrick Mahomes Has a Message for Texas Tech Football
The Red Raiders didn't capitalize on the fumbles in the third quarter but they at least kept the Longhorns off the field. After the two teams traded field goals, Kris Boyd intercepted McLane to give Texas good field possession.

Apple's Black Friday deals are pretty bad , so get these instead
Looking for discounts on Apple gear from other retailers? We will update you guys as soon as we hear more details on the matter. SAVE Add items to your online shopping basket or save the links to your bookmarks to revisit on the day.