3 ms·
It wasn't limited to local access. This tweet should have got much more coverage at the time (note that ARD is Apple Remote Desktop): https://twitter.com/unsy
by SyneRyder 9y ago
It wasn't limited to local access. This tweet should have got much more coverage at the time (note that ARD is Apple Remote Desktop):
https://twitter.com/unsynchronized/status/935656609140711426 https://twitter.com/unsynchronized/status/935656609140711426
"macos 10.13 bug isn't limited to root in all circumstances; via ARD, you can log in as any existing user (e.g. _applepay) and share the screen of the logged-in user. also _uucp is allowed to log in"
- kemayo 9y agoIt was limited to local access for people using the default settings, though, since ARD is something you have to explicitly enable in the system preference. Not that this isn't a bad thing, but it's vastly better than a remote execution exploit which is default-enabled.