7 ms·

Haven't seen this mentioned anywhere so far but this was not a remote vulnerability right? Only from login screen, right !! ??

bsaul 9y ago
From what i understood it's not a remote vulnerability until someone actually activates the "root user with empty password" locally using the vulnerability.
- xraystyle 9y ago
  You could exploit it with remote desktop. If it's enabled on the client, you can just connect with root/no password.
lucideer 9y ago
It's from any login prompt, and it gives root, so it's an elevation vulnerability that could be leveraged by a local or remote process with limited privileges to gain elevated privileges.
mey 9y ago
Once the exploit is done (clicking the unlock button w/ the user root on the settings pane), the root account is setup with a blank password. At this point any remote access methods that use the accounts on the system should allow access. Depending on SSH config, root may be disallowed. I've seen rumors otherwise, but until someone with experience verifies those pathways I can only guess.
- pilsetnieks 9y ago
  Not any method. It worked for screen sharing but it did not for SSH, even after the bug was triggered locally.
  - jlgaddis 9y ago
    I'm not near a macOS box at the moment, but I believe that PermitRootLogin no is set in /private/etc/ssh/sshd_config
jorisw 9y ago
I read that it worked even with Remote Management and Screen Sharing. https://twitter.com/voretaq7/status/935609138725425153 https://twitter.com/voretaq7/status/935609138725425153
- mikeash 9y ago
  Which means that by default, a Mac would not by vulnerable remotely, but you'd only have to click one checkbox to become exposed remotely.
- crankylinuxuser 9y ago
  Yep. We blocked VNC at the border routers. Now you need to use our VPN in order to use VNC. And we are very glad to know we can triage and log. Yeah internal users could still exploit machines. But that fact is recorded. Fired and criminal charges are not a light thing.
  - jlgaddis 9y ago
    So you log and audit this kind of unusual event, but you didn't require VPN access for critical resources?
    - crankylinuxuser 9y ago
      I'm not going to talk about our intricacies of security. But it should go without saying that all the critical stuff is much more locked down. This policy applies to everyone. Students, faculty, staff. Previously, a student could set up VNC to allow remote access to their machine in their dorm. Now it takes VPN to do so.

bsaul 9y ago

From what i understood it's not a remote vulnerability until someone actually activates the "root user with empty password" locally using the vulnerability.

xraystyle 9y ago
You could exploit it with remote desktop. If it's enabled on the client, you can just connect with root/no password.

lucideer 9y ago

It's from any login prompt, and it gives root, so it's an elevation vulnerability that could be leveraged by a local or remote process with limited privileges to gain elevated privileges.

mey 9y ago

Once the exploit is done (clicking the unlock button w/ the user root on the settings pane), the root account is setup with a blank password. At this point any remote access methods that use the accounts on the system should allow access. Depending on SSH config, root may be disallowed. I've seen rumors otherwise, but until someone with experience verifies those pathways I can only guess.

pilsetnieks 9y ago
Not any method. It worked for screen sharing but it did not for SSH, even after the bug was triggered locally.
- jlgaddis 9y ago
  I'm not near a macOS box at the moment, but I believe that PermitRootLogin no is set in /private/etc/ssh/sshd_config

jorisw 9y ago

I read that it worked even with Remote Management and Screen Sharing. https://twitter.com/voretaq7/status/935609138725425153 https://twitter.com/voretaq7/status/935609138725425153

mikeash 9y ago
Which means that by default, a Mac would not by vulnerable remotely, but you'd only have to click one checkbox to become exposed remotely.
crankylinuxuser 9y ago
Yep. We blocked VNC at the border routers. Now you need to use our VPN in order to use VNC. And we are very glad to know we can triage and log. Yeah internal users could still exploit machines. But that fact is recorded. Fired and criminal charges are not a light thing.
- jlgaddis 9y ago
  So you log and audit this kind of unusual event, but you didn't require VPN access for critical resources?
  - crankylinuxuser 9y ago
    I'm not going to talk about our intricacies of security. But it should go without saying that all the critical stuff is much more locked down. This policy applies to everyone. Students, faculty, staff. Previously, a student could set up VNC to allow remote access to their machine in their dorm. Now it takes VPN to do so.