3 ms·

Can this be used remotely? Edit: Yes, after turning on Remote Management on my second mac I was able to log into it using Remote Desktop, account root and no pw

Can this be used remotely? Edit: Yes, after turning on Remote Management on my second mac I was able to log into it using Remote Desktop, account root and no pw. It only works after getting physical access once.

rcruzeiro 9y ago
Been wondering that myself since it seems that this also happens with the login screen.
swozey 9y ago
Yes, I just had a coworker test it after I enabled remote management and they used screensharing.app. I didn't even get notified a user remoted in.. never used screen share, that seems awful. Had to look over and ask if he was in. edit: I should say, I did test this locally first so I don't know if a fresh machine that hasn't done it will do the same thing and let a remote account enable root.. Would like to hear if anyone tested it remotely WITHOUT doing it locally first.
deleted 9y ago
[deleted]
pilif 9y ago
It only works after getting physical access once to enable the root user by gibing any password UI the root user with no password (which will enable the local root account, which is also why it fails the first time around)
djrogers 9y ago
I tested this by logging in as root at a preference pane then attempting to connect via ssh and screen sharing (both enabled) using root with no password. It did not work. Not sure if you'd get different results after logging in as root at the login screen...
CGamesPlay 9y ago
You can get undetectble remote access on most machines given "physical access once", so I don't think this qualifies as "remotely exploitable".
- thomastjeffery 9y ago
  If root was ever enabled without setting a password, the machine is then in a state that it can be remotely exploitable. While it's unlikely, there are probably plenty of users who have done this for some reason or another. Don't underestimate a user's ability to blindly do things like this by following arcane instructions in attempts to fix an unrelated problem.
- fattire 9y ago
  Not according to this video: https://www.youtube.com/watch?v=FpOH0lxEGBE https://www.youtube.com/watch?v=FpOH0lxEGBE They seem to be remotely accessing the machine to both set and then use the root account.
  - inflector 9y ago
    The system needs to have some sort of remote access, like screen sharing, turned on first, then you can remotely use the root account.

rcruzeiro 9y ago

Been wondering that myself since it seems that this also happens with the login screen.

swozey 9y ago

Yes, I just had a coworker test it after I enabled remote management and they used screensharing.app. I didn't even get notified a user remoted in.. never used screen share, that seems awful. Had to look over and ask if he was in. edit: I should say, I did test this locally first so I don't know if a fresh machine that hasn't done it will do the same thing and let a remote account enable root.. Would like to hear if anyone tested it remotely WITHOUT doing it locally first.

deleted 9y ago

[deleted]

pilif 9y ago

It only works after getting physical access once to enable the root user by gibing any password UI the root user with no password (which will enable the local root account, which is also why it fails the first time around)

djrogers 9y ago

I tested this by logging in as root at a preference pane then attempting to connect via ssh and screen sharing (both enabled) using root with no password. It did not work. Not sure if you'd get different results after logging in as root at the login screen...

CGamesPlay 9y ago

You can get undetectble remote access on most machines given "physical access once", so I don't think this qualifies as "remotely exploitable".

thomastjeffery 9y ago
If root was ever enabled without setting a password, the machine is then in a state that it can be remotely exploitable. While it's unlikely, there are probably plenty of users who have done this for some reason or another. Don't underestimate a user's ability to blindly do things like this by following arcane instructions in attempts to fix an unrelated problem.
fattire 9y ago
Not according to this video: https://www.youtube.com/watch?v=FpOH0lxEGBE https://www.youtube.com/watch?v=FpOH0lxEGBE They seem to be remotely accessing the machine to both set and then use the root account.
- inflector 9y ago
  The system needs to have some sort of remote access, like screen sharing, turned on first, then you can remotely use the root account.