5 ms·

This bug exists regardless of user reproducing it or not. If there is anything good, reproducing it actually brings awareness to the user (make them change the

This bug exists regardless of user reproducing it or not. If there is anything good, reproducing it actually brings awareness to the user (make them change the password maybe). Hacker will "enable" the root user anyway. What should be done is that Apple releases fix to this problem.

devindotcom 9y ago
Yeah that was my thought initially too but there may be invisible ways to leverage an existing root user that we're not aware of. After all, this bug exists...
- stingraycharles 9y ago
  The issue is that the bug leaves a password-less root account available through other means as well. Once you try to reproduce the bug, an attacker could potentially do a remote root login without password. As such, it's very dangerous for people to try to verify and should be strongly discouraged.
  - mcintyre1994 9y ago
    If you have remote login enabled does root/no password not work already because of the bug? It apparently does from the login screen if you have username/password mode on, so I wouldn't be surprised if it worked over remote login by default.
    - djrogers 9y ago
      Does not work via ssh or screen sharing based on my testing here. Seems to require physical access to the machine.
      - mcintyre1994 9y ago
        Does seem to work with some software: https://mobile.twitter.com/patrickwardle/status/935639234437935105 https://mobile.twitter.com/patrickwardle/status/935639234437...
    - pilsetnieks 9y ago
      No, it doesn't work for remote login.
  - jldugger 9y ago
    On most systems, root without password isn't available remotely. Is this not true on OSX?
    - jldugger 9y ago
      Apparently, High Sierra has a 'feature' that updates hashes to a new format on login, and consequently publishes a hash where there was none before. Which pretty much disables the 'no hash, no login' policies. Ooops. Donno if that's unique to the GUI, or if a simple 'sudo su -' would also trigger, as I don't own a mac.
Jedd 9y ago
Not the case. Once you enable root access - by 'testing' this - others can remotely & silently access the system as root. GP is right - don't encourage people to test this, as there's nothing to gain from it. If you're on a shared machine you need to mitigate. If you're on your own dedicated machine you need to not share it until this is fixed.
- djrogers 9y ago
  > Once you enable root access - by 'testing' this - others can remotely & silently access the system as root. That's not accurate. The user appears to be there either way, but attempting to log in to a machine remotely using 'root' and no password does not work - even after doing the preference pane thing...
  - Jedd 9y ago
    I don't have access to a vulnerable machine -- just going by comments in the other HN thread. root account is 'there' all the time, yes. This process enables the account proper (rather than just sudo). Evidently some remote mechanisms using root work after the account is enabled.
  - geoelectric 9y ago
    Wonder if people tried screen share/vnc with that theory. I'd suspect anything gui-driven.
- thomastjeffery 9y ago
  > others can remotely & silently access the system as root. They already can: https://gfycat.com/gifs/detail/sentimentalnaiveantelopegroundsquirrel https://gfycat.com/gifs/detail/sentimentalnaiveantelopegroun...
  - sitharus 9y ago
    This does not work if the root user has not been enabled locally. Source: Just tried it myself.
- 9y ago
arghwhat 9y ago
This vulnerability lets users activate the root user without using their password. Once done, you have opened for root without password globally. That's bad. What they should do, as responsible disclosure dictates, is report it in secret to apple, and at most publicize a workaround (activate root user, set password) without reporting the details of the vulnerability. EDIT: It does not appear to be limited to admin users. It appears to be related to disabled root accounts of older origin, such as through upgrades. I cannot reproduce on a fresh High Sierra install, but I reproduced on an upgraded install.
- sounds 9y ago
  I agree that we need more responsible disclosure. But as https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-w... explains, blame the DMCA. Somebody in Turkey has no expectation that they will be treated with respect. It's much more likely they will be attacked as in "shoot the messenger." (So, please don't attack the person who brought this to our attention.) I think they made a reasonable decision, due to the critical nature of this bug, and tweeted about it.
  - arghwhat 9y ago
    But throwing it on twitter doesn't stop you from using the DMCA, and having the DMCA used against you doesn't stop you from posting it on Twitter as counter-measure (which might make the company retract the use of DMCA to avoid publicity about suing "messengers"). If you're afraid of DMCA, keep your mouth shut and stay away from the US. The DMCA is a disgusting and absurd set of laws that can always make me angry. Its existence alone proves very much how big companies can rule with money, placing capitalism over democracy.
- jmuguy 9y ago
  I run as a standard user and was able to reproduce the bug.
  - arghwhat 9y ago

devindotcom 9y ago

Yeah that was my thought initially too but there may be invisible ways to leverage an existing root user that we're not aware of. After all, this bug exists...

stingraycharles 9y ago
The issue is that the bug leaves a password-less root account available through other means as well. Once you try to reproduce the bug, an attacker could potentially do a remote root login without password. As such, it's very dangerous for people to try to verify and should be strongly discouraged.
- mcintyre1994 9y ago
  If you have remote login enabled does root/no password not work already because of the bug? It apparently does from the login screen if you have username/password mode on, so I wouldn't be surprised if it worked over remote login by default.
  - djrogers 9y ago
    Does not work via ssh or screen sharing based on my testing here. Seems to require physical access to the machine.
    - mcintyre1994 9y ago
      Does seem to work with some software: https://mobile.twitter.com/patrickwardle/status/935639234437935105 https://mobile.twitter.com/patrickwardle/status/935639234437...
  - pilsetnieks 9y ago
    No, it doesn't work for remote login.
- jldugger 9y ago
  On most systems, root without password isn't available remotely. Is this not true on OSX?
  - jldugger 9y ago
    Apparently, High Sierra has a 'feature' that updates hashes to a new format on login, and consequently publishes a hash where there was none before. Which pretty much disables the 'no hash, no login' policies. Ooops. Donno if that's unique to the GUI, or if a simple 'sudo su -' would also trigger, as I don't own a mac.

Jedd 9y ago

Not the case. Once you enable root access - by 'testing' this - others can remotely & silently access the system as root. GP is right - don't encourage people to test this, as there's nothing to gain from it. If you're on a shared machine you need to mitigate. If you're on your own dedicated machine you need to not share it until this is fixed.

djrogers 9y ago
> Once you enable root access - by 'testing' this - others can remotely & silently access the system as root. That's not accurate. The user appears to be there either way, but attempting to log in to a machine remotely using 'root' and no password does not work - even after doing the preference pane thing...
- Jedd 9y ago
  I don't have access to a vulnerable machine -- just going by comments in the other HN thread. root account is 'there' all the time, yes. This process enables the account proper (rather than just sudo). Evidently some remote mechanisms using root work after the account is enabled.
- geoelectric 9y ago
  Wonder if people tried screen share/vnc with that theory. I'd suspect anything gui-driven.
thomastjeffery 9y ago
> others can remotely & silently access the system as root. They already can: https://gfycat.com/gifs/detail/sentimentalnaiveantelopegroundsquirrel https://gfycat.com/gifs/detail/sentimentalnaiveantelopegroun...
- sitharus 9y ago
  This does not work if the root user has not been enabled locally. Source: Just tried it myself.
9y ago

arghwhat 9y ago

This vulnerability lets users activate the root user without using their password. Once done, you have opened for root without password globally. That's bad. What they should do, as responsible disclosure dictates, is report it in secret to apple, and at most publicize a workaround (activate root user, set password) without reporting the details of the vulnerability. EDIT: It does not appear to be limited to admin users. It appears to be related to disabled root accounts of older origin, such as through upgrades. I cannot reproduce on a fresh High Sierra install, but I reproduced on an upgraded install.

sounds 9y ago
I agree that we need more responsible disclosure. But as https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-w... explains, blame the DMCA. Somebody in Turkey has no expectation that they will be treated with respect. It's much more likely they will be attacked as in "shoot the messenger." (So, please don't attack the person who brought this to our attention.) I think they made a reasonable decision, due to the critical nature of this bug, and tweeted about it.
- arghwhat 9y ago
  But throwing it on twitter doesn't stop you from using the DMCA, and having the DMCA used against you doesn't stop you from posting it on Twitter as counter-measure (which might make the company retract the use of DMCA to avoid publicity about suing "messengers"). If you're afraid of DMCA, keep your mouth shut and stay away from the US. The DMCA is a disgusting and absurd set of laws that can always make me angry. Its existence alone proves very much how big companies can rule with money, placing capitalism over democracy.
jmuguy 9y ago
I run as a standard user and was able to reproduce the bug.
- arghwhat 9y ago