3 ms·
This is the remnant of a previous OSX feature, that is you could go into single user mode, type passwd root, then create a password, then login with root / pass
by empressplay 9y ago
This is the remnant of a previous OSX feature, that is you could go into single user mode, type passwd root, then create a password, then login with root / password. I guess there's a lesson here about complexity.
- empressplay 9y agoI should note that single user mode / passwd root thing has been around for quite some time, so remember kids, the only security is physical security...
- nixpulvis 9y agoSome mathematicians would disagree, but let's not go there.
- rjmunro 9y agoI think that if you have FileVault enabled and you shut the machine down when not in use, you are still secure, even from this attack.
- lloeki 9y agoIt is expected behaviour that on unix-like systems booting in single user mode leaves you with /bin/sh as init or something very much alike, and, obviously, being root. This is no different than booting a live{cd,usb} and at that point you're a mount/chroot/passwd away from resetting the password. Unless the disk is encrypted of course.
- rjmunro 9y agoThe article doesn't seem to say that according to my reading. The article says it is about verifying the legacy password when upgrading to a new-format password hash.
- code_duck 9y agoOn most Linux systems you can do 'sudo passwd'. But that has nothing to do with how this vuln occurs, i'm sure.