Horrifying macOS Bug Lets Anyone Become Admin With No Password

Credit IDG

"Twitter user Lemi Orhan Ergin, a software engineer out of Turkey tweeted that there was a "*HUGE*" security issue with High Sierra.

This is a critical bug that allows anyone on a Mac to log in and change the admin settings - using just the username "root" with no password.

What makes this flaw so unsafe is people are reporting it also allows for full keychain access and any login where a user name and password is required, even via remote access via OS X screenshare. Enter "root" as the username and leave the password field empty. It's the highest level of access, and the account is normally disabled.

A massive security hole affecting Mac computers running the latest version of MacOS High Sierra has been discovered.

Horrifying macOS Bug Lets Anyone Become Admin With No Password

We can confirm the bug is present in macOS 10.13.1 and for anyone with a Mac in a public office space, you are urged to fix this by yourself, immediately.

Once a password has been set for the "root" account, the flaw that allows a person to login as "root" with no password will no longer work. Those running previous versions of MacOS including Sierra and Yosemite do not appear to be affected by the bug. Apple is generally good about patching issues like this quickly but for now, machines will remain vulnerable until they can push any updates.

Apple is yet to comment, but I suspect a quick trip to the locksmith is in order. The macOS login screen does not let you change the user name. Changing the root password is the workaround for now.

Related News:



Most liked

Civilization VI: Rise and Fall Expansion Announced with February 8 Release
If you escape from a Dark Age is especially successful, you will enter a Heroic Age, a stronger version of a Golden Age. The aim behind these new Ages is to add an additional element of challenge and variety to the series.

Pope Francis and Aung San Suu Kyi avoid Rohingya crisis discussion
Her late husband, Mr Michael Aris, was a lecturer there, and the couple lived and raised their two sons in the city. Refugees say the Myanmar's military has murdered children, raped women and razed villages.

Deja vu as late Arsenal penalty sinks Burnley
That Arsenal's likeliest candidate was centre-half Shkodran Mustafi says plenty about the way they did business. This time some Gudmundsson trickery bought a yard and he crossed towards the lurking Ashley Barnes.

Weight Loss: How cinnamon (Dalchini) can help you lose weight
Australian researchers found cinnamon will help lower the stomach temperature - which aids digestion - up to two degrees. Cinnamon has a long history of use in traditional medicine and is a peculiar ingredient of person's diet.

Lamar Jackson and Kentucky Player Spark Huge Louisville-Kentucky Fight
Louisville retook the Governor's Cup from United Kingdom , who took it in Louisville last season after a 41-38 win. Unfortunately for United Kingdom , it wasn't enough to overcome the offensive attack Louisville poured on.

Flynn reportedly cut ties with Trump, indicating potential cooperation with Mueller
It is not unusual for legal teams working for the defence to share information during large criminal investigations. Flynn nor other former aides has incriminating information to provide about Mr.

Courtois: Contract talks with Chelsea haven't developed
Courtois has made 125 appearances for the Blues in all competitions since linking up with the first team in 2014. Thibaut Courtois will delay further talks over a new Chelsea contract until the end of the season.

Alabama pastor: I'd back Moore even if sexual assault allegations were true
Moore's wife, Kayla Moore, has said he won't step down from the race, as Senate Majority Leader Mitch McConnell has called for. Asked about Moore's denial - he's said he doesn't know Corfman - she was skeptical: "I wonder how many mes he doesn't know".

India declare on 352-8, set Sri Lanka 231 to win
Sri Lanka were reeling on 75 for seven, chasing a target of 231, before the umpires ruled the light too poor to continue. He went down on one knee and roared in delight with a clenched fist towards the dressing room.

Donald Trump nuclear order could be refused - General John Hyten
The top US nuclear commander said there is protocol in place to contest a strike order given by a President if it were "illegal". The comments come amid heightened tensions between the U.S. and North Korea, with inflammatory comments issued from both sides.

Apple to miss holiday season with HomePod speaker
The first quarter of 2018 may see the speakers being shipped to the United States , the UK and the Australian markets. But voice control is created to work only with Apple Music, the company's $10 a month subscription service.

Pakistan's Mohammad Hazeef suspended by ICC for illegal bowling action
His action was first reported in November 2014 and after initial suspension he was allowed to bowl again in April 2015. He tweeted after the news of his suspension came out that he will work twice as hard to rectify his action this time.

George Clooney Will Star in and Direct 'Catch 22' Series
The episodes for the series have been written by Luke Davies and David Michod, who are also executive producing the project. George Clooney is returning to television, almost two decades since his last appearance on the hit medical drama ER.

Venezuela's Bond-Payment Delays Trigger 'Credit Event'
Ratings on those bonds also will be lowered to "D", of default, if not paid on time, it said. Investors buy CDS as a hedge or insurance on that debt.

Loftus-Cheek feeling less pressurised at Crystal Palace
England are a very strong team with young players, quality players. "A very good player", Willian said. They can improve a lot, like us.