3 ms·
You'd still need physical access to a logged-in machine to exploit it. I'm not sure what the latest default is as to Guest accounts and whether or not those can
by ben174 9y ago
You'd still need physical access to a logged-in machine to exploit it. I'm not sure what the latest default is as to Guest accounts and whether or not those can exploit it, but it's a significantly different story if it requires you to exploit it on an unattended logged in machine.
If guest accounts are enabled by default and a guest account can exploit it, yea.. that's pretty bad.
- miles 9y ago> You'd still need physical access to a logged-in machine to exploit it Not necessarily; this aspect was unfortunately underreported: "macos 10.13 bug isn't limited to root in all circumstances; via ARD, you can log in as any existing user (e.g. _applepay) and share the screen of the logged-in user. also _uucp is allowed to log in" https://twitter.com/unsynchronized/status/935656609140711426 https://twitter.com/unsynchronized/status/935656609140711426
- X-Istence 9y agoThe defaults don't allow for remote management, screen sharing, or SSH or anything. Most of these devices are going to be sold without those options ever being touched. So that limits things in terms of who is affected.
- Someone1234 9y agoNone of which makes this statement any less inaccurate: > You'd still need physical access to a logged-in machine to exploit it.
- miles 9y ago> None of which makes this statement any less inaccurate: >> You'd still need physical access to a logged-in machine to exploit it. Yes it does; if Remote Management was enabled (as is often the case for remote servers or mass deployments), an attacker could login via Apple Remote Desktop using default, pre-existing user accounts (_applepay, _uucp, etc) and a blank password without ever needing physical access. Just tested again with a new, unpatched install of 10.13.1 on one Mac, connecting via Screen Sharing from another. To be clear, I never logged in as root on the 10.13.1 Mac at all, even via the exploit.
- 59nadir 9y agoYou are agreeing with the comment you're replying to. He/she was saying that the defaults being what they are do not make the statement that you need physical access any less inaccurate.
- miles 9y agoThank you for the kind correction and clarification, 59nadir. And my apologies to you, Someone1234, for having hastily misread your comment.
- miles 9y agoJust as a very simple, isolated example, think of all the Mac Mini servers with Remote Management enabled at https://macminicolo.net https://macminicolo.net . As I mentioned below, this remote exploit did NOT require ever logging in as root, whether with or without a password. This was a much more serious bug than is commonly understood.
- Someone1234 9y ago> You'd still need physical access to a logged-in machine to exploit it. You don't. You can exploit it from the login screen after a machine wakes from sleep, you can also exploit it remotely via Screen Sharing.
- thecynh 9y agoBut from a shut-off machine it wasn't exploitable? Have an iMac sitting at work (turned off) and am on vacation =)