Horrifying macOS Bug Lets Anyone Become Admin With No Password

Credit IDG

"Twitter user Lemi Orhan Ergin, a software engineer out of Turkey tweeted that there was a "*HUGE*" security issue with High Sierra.

This is a critical bug that allows anyone on a Mac to log in and change the admin settings - using just the username "root" with no password.

What makes this flaw so unsafe is people are reporting it also allows for full keychain access and any login where a user name and password is required, even via remote access via OS X screenshare. Enter "root" as the username and leave the password field empty. It's the highest level of access, and the account is normally disabled.

A massive security hole affecting Mac computers running the latest version of MacOS High Sierra has been discovered.

Horrifying macOS Bug Lets Anyone Become Admin With No Password

We can confirm the bug is present in macOS 10.13.1 and for anyone with a Mac in a public office space, you are urged to fix this by yourself, immediately.

Once a password has been set for the "root" account, the flaw that allows a person to login as "root" with no password will no longer work. Those running previous versions of MacOS including Sierra and Yosemite do not appear to be affected by the bug. Apple is generally good about patching issues like this quickly but for now, machines will remain vulnerable until they can push any updates.

Apple is yet to comment, but I suspect a quick trip to the locksmith is in order. The macOS login screen does not let you change the user name. Changing the root password is the workaround for now.

Related News:



Most liked

Pope Francis and Aung San Suu Kyi avoid Rohingya crisis discussion
Her late husband, Mr Michael Aris, was a lecturer there, and the couple lived and raised their two sons in the city. Refugees say the Myanmar's military has murdered children, raped women and razed villages.

Sisi calls emergency meeting after more than 80 killed at Sinai mosque
Will be calling the President of Egypt in a short while to discuss the tragic terrorist attack, with so much loss of life. Officials said militants in four off-road vehicles bombed the mosque and then sprayed worshipers with gunfire.

Shots fired reported at Oxford Circus tube station in London
Reuters have reported that London's Oxford Circus underground station is being evacuated and that armed police are on the scene. But around 90 minutes after responding, police said there was no evidence of any shots, casualties or suspects.

Tencent Will Publish PlayerUnknown's Battlegrounds in China, with Some Slight Alterations
Chinese tech giant Tencent promised to add "socialist core values" to the game in order to bypass the country's strict censors.

Police enter Australia's Manus Island detention centre
Refugees have little or no protection from these attacks except to live inside detention centres. Refugee advocates said 420 men remained.

Murder On The Orient Express Movie Review
The book had been adapted in 1978 into a movie with Peter Ustinov, Bette Davis, Mia Farrow and Maggie Smith in the cast. Christie first published Death on the Nile in 1937, three years after her Murder on the Orient Express was published.

Nebraska OK's Keystone XL Pipeline, but more obstacles in the horizon
TransCanada wants to build the almost 1,200-mile Keystone XL pipeline from Canada through several states, including South Dakota. Ongoing legal challenges to the project, and the change of route in Nebraska could add further complications.

India declare on 352-8, set Sri Lanka 231 to win
Sri Lanka were reeling on 75 for seven, chasing a target of 231, before the umpires ruled the light too poor to continue. He went down on one knee and roared in delight with a clenched fist towards the dressing room.

Donald Trump nuclear order could be refused - General John Hyten
The top US nuclear commander said there is protocol in place to contest a strike order given by a President if it were "illegal". The comments come amid heightened tensions between the U.S. and North Korea, with inflammatory comments issued from both sides.

Pakistan's Mohammad Hazeef suspended by ICC for illegal bowling action
His action was first reported in November 2014 and after initial suspension he was allowed to bowl again in April 2015. He tweeted after the news of his suspension came out that he will work twice as hard to rectify his action this time.

Gerry Adams to announce retirement as Sinn Féin president today
Last night, the party voted in favour of a motion to hold a special conference on any decision to enter coalition government. Many believe Sinn Fein's popularity among voters is hampered by the presence of leaders from Ireland's era of Troubles.

George Clooney Will Star in and Direct 'Catch 22' Series
The episodes for the series have been written by Luke Davies and David Michod, who are also executive producing the project. George Clooney is returning to television, almost two decades since his last appearance on the hit medical drama ER.

Venezuela's Bond-Payment Delays Trigger 'Credit Event'
Ratings on those bonds also will be lowered to "D", of default, if not paid on time, it said. Investors buy CDS as a hedge or insurance on that debt.

'Ultimate completion of the nuclear force': North Korea rules out negotiations
United States lieutenant colonel serves as its commander, while South Korea's lieutenant colonel serves as his deputy. The soldier's condition was "not surprising at all considering the north's hygiene and parasite problems", he said.

Loftus-Cheek feeling less pressurised at Crystal Palace
England are a very strong team with young players, quality players. "A very good player", Willian said. They can improve a lot, like us.