4 ms·
Am I missing something or does this require the attacker to have access to an unlocked computer? In which case all bets are off anyways.
by senko 9y ago
Am I missing something or does this require the attacker to have access to an unlocked computer? In which case all bets are off anyways.
- valine 9y agoIt works remotely if remote login is enable. edit: Screen sharing is is vulnerable not ssh. Either way its bad.
- djrogers 9y agoNo it does not. I tested this rather carefully, and both ssh and screen sharing do not allow the user root with no password.
- ehntoo 9y agoI have not been able to trigger this with ssh, but certainly have been able to with Screen Sharing, even after explicitly re-disabling the root account.
- jonny_eh 9y agoWhat if it's a stolen laptop with an encrypted hard drive?
- jzwinck 9y agoIt requires the attacker to be able to type a few characters into a logged in session. If the session is not an administrative one, it's not fair to say all bets were off. If I give you a Mac logged in with an unprivileged account and you can use only the keyboard and mouse to gain root access, the security has failed. I think you've conflated this with the attacker having (full) physical access to the machine, which conventionally means access to its ports and perhaps a screwdriver. This is not that.
- senko 9y agoFair point, if that works with a guest account. I was thinking along the lines of, if I have write access to your .bashrc (or a multitude of other config files that you as an unprivileged user have write access to, and can be used to trick you later into running code of my choosing), all bets are off.
- devindotcom 9y agonope. you can log in at the login screen, it creates a new root admin user
- senko 9y agoMissed that part in the text, thanks. Yikes!
- woodrowbarlow 9y agoan unlocked computer, or: * a computer with remote login enabled * a computer with the main login screen set to "username and password" mode * a computer with a guest account
- EpicEng 9y ago>In which case all bets are off anyways How are all bets off if they don't have access to a root user? This isn't Windows we're talking about.
- senko 9y agoIf they have access to the account that is being used normally, they can modify the (user-accessible) settings to trick the user into running malicious code and giving them access (or causing trouble even without access to the root account).
- mholt 9y agoIf you lose physical control over the machine, all bets are off because an attacker can modify the hardware to do nefarious things.
- code_duck 9y agoThe 'attacker' could be someone like your 12 year old son or an employee, who already has access to the computer but not necessarily everything on it at all times. This would have been a pain for me when i was using parental restrictions to lock a 12 year old out of 18 hour a day Minecraft.