4 ms·
The defaults don't allow for remote management, screen sharing, or SSH or anything. Most of these devices are going to be sold without those options ever being
by X-Istence 9y ago
The defaults don't allow for remote management, screen sharing, or SSH or anything. Most of these devices are going to be sold without those options ever being touched.
So that limits things in terms of who is affected.
- Someone1234 9y agoNone of which makes this statement any less inaccurate: > You'd still need physical access to a logged-in machine to exploit it.
- miles 9y ago> None of which makes this statement any less inaccurate: >> You'd still need physical access to a logged-in machine to exploit it. Yes it does; if Remote Management was enabled (as is often the case for remote servers or mass deployments), an attacker could login via Apple Remote Desktop using default, pre-existing user accounts (_applepay, _uucp, etc) and a blank password without ever needing physical access. Just tested again with a new, unpatched install of 10.13.1 on one Mac, connecting via Screen Sharing from another. To be clear, I never logged in as root on the 10.13.1 Mac at all, even via the exploit.
- 59nadir 9y agoYou are agreeing with the comment you're replying to. He/she was saying that the defaults being what they are do not make the statement that you need physical access any less inaccurate.
- miles 9y agoThank you for the kind correction and clarification, 59nadir. And my apologies to you, Someone1234, for having hastily misread your comment.
- miles 9y agoJust as a very simple, isolated example, think of all the Mac Mini servers with Remote Management enabled at https://macminicolo.net https://macminicolo.net . As I mentioned below, this remote exploit did NOT require ever logging in as root, whether with or without a password. This was a much more serious bug than is commonly understood.