3 ms·

This vulnerability lets users activate the root user without using their password. Once done, you have opened for root without password globally. That's bad.

This vulnerability lets users activate the root user without using their password. Once done, you have opened for root without password globally. That's bad. What they should do, as responsible disclosure dictates, is report it in secret to apple, and at most publicize a workaround (activate root user, set password) without reporting the details of the vulnerability. EDIT: It does not appear to be limited to admin users. It appears to be related to disabled root accounts of older origin, such as through upgrades. I cannot reproduce on a fresh High Sierra install, but I reproduced on an upgraded install.

sounds 9y ago
I agree that we need more responsible disclosure. But as https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-w... explains, blame the DMCA. Somebody in Turkey has no expectation that they will be treated with respect. It's much more likely they will be attacked as in "shoot the messenger." (So, please don't attack the person who brought this to our attention.) I think they made a reasonable decision, due to the critical nature of this bug, and tweeted about it.
- arghwhat 9y ago
  But throwing it on twitter doesn't stop you from using the DMCA, and having the DMCA used against you doesn't stop you from posting it on Twitter as counter-measure (which might make the company retract the use of DMCA to avoid publicity about suing "messengers"). If you're afraid of DMCA, keep your mouth shut and stay away from the US. The DMCA is a disgusting and absurd set of laws that can always make me angry. Its existence alone proves very much how big companies can rule with money, placing capitalism over democracy.
jmuguy 9y ago
I run as a standard user and was able to reproduce the bug.
- arghwhat 9y ago
  Updated. I was unable to reproduce on another machine as a standard user, but it appears to be related to it being a fresh install of High Sierra, not an upgraded install with old disabled root user entries.
throwaway2048 9y ago
"responsible disclosure" isn't some morally unassailable high ground, but companies like apple sure want you to believe it is.
- arghwhat 9y ago
  Care to explain the comment about Apple? I can think of a few companies (DJI, for example) that try to screw over security researchers, but big IT companies usually don't go on the list.
  - lawnchair_larry 9y ago
    Most of the big companies will take their sweet time to fix something if it suits them. Not always, but sometimes they just won't feel like getting around to it, and they know that as a "responsible" researcher, you will keep your mouth shut about it. I'm talking like a year. I've seen this with the "researcher friendly" companies. In my opinion, there's a point at which it becomes irresponsible to let them sit on issues for so long, but their newspeak for the disclosure policy tries to pre-empt that idea.
    - saagarjha 9y ago
      That's when you put a clear timeline for how long you will wait before disclosing when you report these bugs.
    - arghwhat 9y ago
      I have heard of many incidents like this from various companies, but not Apple that I know of. But yes, responsible disclosure includes a deadline (60 days?). Flexibility granted if the company truly needs it, and the nature of the vulnerability requires discretion until fixed. A major widespread flaw with no workaround short of air-gapping the machine would be wise to keep secret until fixed.
      - lawnchair_larry 9y ago
        90 days, and Apple in fact are a noteworthy example. They have repeatedly missed the deadline and had full disclosure by GPZ, with widespread flaws, complete with exploit code. Microsoft are the other big one. The "right" thing is far more complicated than people who have no experience working with vendors to fix bugs like to assert. There is some game theory here. The rationale is that if vendors know that GPZ will sit on their vuln until it is fixed, they are not forced to take the deadline seriously. For that reason, GPZ must remain firm on their deadlines, and everyone knows that if you try to call their bluff, you are going to lose that bet and have an even bigger mess.

sounds 9y ago

I agree that we need more responsible disclosure. But as https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-we-just-lost-web-what-we-learned-it-and-what-we-need-do-next https://www.eff.org/deeplinks/2017/10/drms-dead-canary-how-w... explains, blame the DMCA. Somebody in Turkey has no expectation that they will be treated with respect. It's much more likely they will be attacked as in "shoot the messenger." (So, please don't attack the person who brought this to our attention.) I think they made a reasonable decision, due to the critical nature of this bug, and tweeted about it.

arghwhat 9y ago
But throwing it on twitter doesn't stop you from using the DMCA, and having the DMCA used against you doesn't stop you from posting it on Twitter as counter-measure (which might make the company retract the use of DMCA to avoid publicity about suing "messengers"). If you're afraid of DMCA, keep your mouth shut and stay away from the US. The DMCA is a disgusting and absurd set of laws that can always make me angry. Its existence alone proves very much how big companies can rule with money, placing capitalism over democracy.

jmuguy 9y ago

I run as a standard user and was able to reproduce the bug.

arghwhat 9y ago
Updated. I was unable to reproduce on another machine as a standard user, but it appears to be related to it being a fresh install of High Sierra, not an upgraded install with old disabled root user entries.

throwaway2048 9y ago

"responsible disclosure" isn't some morally unassailable high ground, but companies like apple sure want you to believe it is.

arghwhat 9y ago
Care to explain the comment about Apple? I can think of a few companies (DJI, for example) that try to screw over security researchers, but big IT companies usually don't go on the list.
- lawnchair_larry 9y ago
  Most of the big companies will take their sweet time to fix something if it suits them. Not always, but sometimes they just won't feel like getting around to it, and they know that as a "responsible" researcher, you will keep your mouth shut about it. I'm talking like a year. I've seen this with the "researcher friendly" companies. In my opinion, there's a point at which it becomes irresponsible to let them sit on issues for so long, but their newspeak for the disclosure policy tries to pre-empt that idea.
  - saagarjha 9y ago
    That's when you put a clear timeline for how long you will wait before disclosing when you report these bugs.
  - arghwhat 9y ago
    I have heard of many incidents like this from various companies, but not Apple that I know of. But yes, responsible disclosure includes a deadline (60 days?). Flexibility granted if the company truly needs it, and the nature of the vulnerability requires discretion until fixed. A major widespread flaw with no workaround short of air-gapping the machine would be wise to keep secret until fixed.
    - lawnchair_larry 9y ago
      90 days, and Apple in fact are a noteworthy example. They have repeatedly missed the deadline and had full disclosure by GPZ, with widespread flaws, complete with exploit code. Microsoft are the other big one. The "right" thing is far more complicated than people who have no experience working with vendors to fix bugs like to assert. There is some game theory here. The rationale is that if vendors know that GPZ will sit on their vuln until it is fixed, they are not forced to take the deadline seriously. For that reason, GPZ must remain firm on their deadlines, and everyone knows that if you try to call their bluff, you are going to lose that bet and have an even bigger mess.