17 ms·

AppStore Preferences can be unlocked by a local admin with any bogus password

382 points by tomduncalf 9y ago

mrmattyboy 9y ago
Can confirm - with my colleagues laptop - much to his amusement :)
atonse 9y ago
I have a feeling this isn't actually that High Sierra is that much worse, but more that people are now actively pen-testing macOS to find the next embarrassing bug. And that scares me even more because of the unknown of how long such bugs must've existed in the system. Is this Apple's Windows XP moment? (Like when MS stopped everything and did massive security training that resulted in XP SP 2 being worlds more secure?)
- CGamesPlay 9y ago
  Well, the root account password bug and this bug both do not reproduce on Sierra, so they were both introduced in High Sierra. Unless you’re arguing that Apple fixed a bunch of undisclosed vulnerabilities when they introduced these, High Sierra is definitely worse.
- gregoriol 9y ago
  Most of the recently discussed High Sierra bugs were not there on Sierra, while the features were there, like this one. So it's not that much pen tensting, but Apple making changes and not validating them correctly. Maybe they have their Vista moment with High Sierra, maybe we forgot previous buggy versions.
  - xattt 9y ago
    Could this be the result of shifting quality assurance to the general public through public betas?
    - gurkendoktor 9y ago
      For security-related bugs, maybe. When I file bugs with Apple (which I've mostly given up on), they are usually marked as a duplicate of another still-open bug. So it seems that people actually file bugs -- free QA works! -- but there's not enough time to fix them.
- rcthompson 9y ago
  High Sierra and Sierra both have enough disruptive bugs in them that I had to downgrade my 2012 Macbook Pro to El Capitan, which did not have those bugs. The most notable one for me was the massive regression in video drivers, that not only made many previously smooth-running games unplayable, but also caused several of the ordinary desktop apps I used to become unacceptably slow.
  - verisimilitude 9y ago
    For me they broke automount (/etc/auto_master). It just... randomly takes root ownership of my smb shares. So I can't get to them. Then it randomly gives me ownership back. Crazy-making. Writing a Cocoa app right now to watch for kCFURLVolumeIsAutomountedKey errors and fix this bug myself.
qaq 9y ago
Cmon Apple I know security people are in short supply but: A) You have the resources B) This is the type of bug that any semi decent QA process should catch anyway
- donatj 9y ago
  It seems like the type of bug that there should be a unit test for.
dalemyers 9y ago
The interesting implication from this is that while it works for the App Store preferences, it doesn't work for the others, showing that there is a manual check that each pane is doing. Why aren't all of these calls identical? If each has to be handled manually, it's no wonder that there are bugs like this appearing.
- christoph 9y ago
  My guess is that the App Store preferences isn't even meant to have the padlock. iCloud prefs doesn't have it, so I can only assume it's there by mistake. If you try the same thing with say "Time & date prefs", it pauses with an incorrect password for a few seconds, then visually shakes indicating it's a wrong password. With the App Store prefs, it just instantly closes the authentication dialog, even with a blank password. I don't really understand the logic as to why some panels in preferences have padlocks and others don't... Why does date/time need admin rights whereas Network (delete/add/reconfigure networking), Internet Accounts (delete/add any accounts?), iCloud (do all manner of things), Time Machine (back a machine up elsewhere?) don't require it?
  - ryanianian 9y ago
    It's concerning there's a UI element that displays as a padlock and shows the standard auth dialog but then doesn't actually do any auth. If this is easy to do by mistake, where else is this hiding?
  - dkonofalski 9y ago
    I would imagine it's because changing the system date/time could be used nefariously whereas iCloud, Internet Accounts, and Network would all require passwords for the individual accounts/networks to do anything with them.
    - pishpash 9y ago
      Date time manipulation can be used to bypass expired certificates.
jtchang 9y ago
If you read the notes: This only appears to be when logged in as a local admin. Tested with a non-admin account and I cannot unlock the prefpane with incorrect credentials. So basically they are checking to see if you have credentials already. I guess this is a caching issue since you locked it.
- oneeyedpigeon 9y ago
  That makes an awful lot of sense, in which case the bug is just not checking that the login is 'cached' before displaying the dialog. In a similar vein to another comment, though, why doesn't that dialog detect the state of the 'login cache' consistently across all occurrences?
briandear 9y ago
Kind of a silly title "AppStore Preferences lock is a lie" -- it isn't a "lie" unless Apple intended for it to not lock correctly. But obviously, it's a bug. It isn't like Apple is trying to deceive users. Interesting bug, unnecessarily hyperbolic title for it.
- pvg 9y ago
  It's supposed to be amusing. Think 'the cake is a lie'.
dcx 9y ago
I'm on 10.12.6 and a local admin account, and it only unlocks to my actual password. That might mean it's a recently-introduced bug (assuming someone else can reproduce my result).
- heartbreak 9y ago
  It doesn't reproduce for me on 10.12.6 either. It only works on High Sierra (10.13).
  - pvg 9y ago
    I can't reproduce it on 10.13.3 Beta (17D29a). So it might have been fixed already.
- hitgeek 9y ago
  yea, it says 10.13.2. I can't reproduce it on 10.13.1.
- spike021 9y ago
  Same here.
  - teilo 9y ago
    I reproduced it in 10.13.2 on the first try.
dajohnson89 9y ago
sorry if this is a dumb question, but: why is it unreasonable for a local admin to have the power to change AppStore preferences? without knowing much about the osx security model, this sounds like not a big deal?
- TheCoreh 9y ago
  On OS X, administrative accounts still need to authenticate with their passwords to perform administrative tasks. This is to avoid (presumably) someone using your computer and changing settings without your consent if you have automatic login enabled, and to make sure you pay attention to what you're doing (similar to the UAC prompts on Windows, and sudo on Windows)
  - TheCoreh 9y ago
    I can no longer edit the comment above, but I meant sudo on linux, not on Windows.
- gregoriol 9y ago
  As long as a password is requested, it has to be checked! Also this wasn't possible on Sierra.
- aetherson 9y ago
  For certain features, they want you to reconfirm that the user presently at the keyboard is the real admin at the moment that you do it. This prevents a situation where the actual admin logs in, their attention is taken away from the computer, and someone sits at their chair and does awful things with the computer.
  - oneeyedpigeon 9y ago
    > For certain features, they want you to reconfirm that the user presently at the keyboard is the real admin at the moment that you do it. If that's the case, no-one told the `sudo` command...
jaimehrubiks 9y ago
Can confirm it doesn't work on "Sierra", so it must be high sierra's feature.
newscracker 9y ago
This does not help at all for the drubbing that macOS High Sierra has been getting recently. Long term OS X users have been waiting for a Snow Leopard like release, but it seems like Apple isn’t taking as much care as required on security and stability on the Mac. Something has to give — either Apple’s organizational structure needs a change or Apple needs to abandon certain things completely instead of releasing sub-standard products that aren’t expected from it. As a long time Mac user, I keep hoping that Apple will decide to double down on better and deeper focus on all its products, including the Mac, its OS and ecosystem, and make the changes necessary across its organization and its teams.
- jezfromfuture 9y ago
  Snow leopard wasn’t all that till it got a few updates either
  - nolok 9y ago
    Didn't use OSX back then, but I think there is a good distance between "not all that" and the security fiasco going on with High Sierra.
    - whhwer823 9y ago
      Security fiascos that most of the time, required one have physical access to the machine in many cases (discounting the recent discovery of Intel bugs). In which case you're screwed anyway. Remember Windows track record as a Swiss cheese POS? They took the complaints, did work to better monitor for issues, now it's a privacy invasion! And how you could basically crack a Mac too, but no one noticed because they weren't as ubiquitous? Selective memory is thing in IT communities. Forgetting that forehead smacking security issues have always been here. Put a Windows XP box online pre-sp1 and instantly get hit with RPC attacks. 'Net security only became a concern for companies in the last decade. And they're still terrible. There are still boxes of disks and tapes being stolen, along with Intel-like bugs we'll never find. But yeah, I'm sure soon we'll figure these all out. Any day now. Just accept it's lowest common denominator engineering and chill.
jaclaz 9y ago
Though it is "queer", it doesn't seem to be that much a security issue, or - more probably - I am failing to understand the risk implied. Can anyone describe a possible scenario where this would pose a security risk?
- foz 9y ago
  A user with access to a mac could enable the option to automatically install macOS updates, which given recent trends, could impose a security risk.
  - briandear 9y ago
    > could impose a security risk How? Installing a Mac OS update could be considered a security risk? That makes little sense since the security risks you're alluding to were solved by updates. 10.13.2 partially fixed the Intel problem in December and 10.13.3 will have more fixes. If you were still running 10.13.1, you'd have both the root login bug and the Intel security issues. If you were still running Sierra, keeping Sierra updated results in solving the following security issues: https://support.apple.com/en-us/HT207483 https://support.apple.com/en-us/HT207483 The Mac OS version out right now is more secure than the previous minor or major version. There really isn't any credible evidence to the contrary. It's irresponsible to not update your system. I understand not moving up to a new version of an OS because of compatibility issues (i.e. audio interfaces often are sluggish to update, libraries you need might not work, etc.,) but not updating because of security fears -- that's just ridiculous. 10.13.3 is more secure than 10.12.2. Also, in order to "exploit" the reported bug, you would have to already be signed into the computer AS AN ADMIN. Which means that you could already change the updating behavior. So unless you are sharing your admin login/account with non admin users, the risk you cite is pretty trivial. If you are in a higher risk computing environment, it would be logical that you would sign out of your account after you've finished using the system -- you would essentially have to provide an unauthorized person access to your Mac while you were signed in before this would be an actual threat. That doesn't make the bug less "real," but it does make the real-world security ramifications much less dire than being implied.
slenk 9y ago
My AppStore preferences do not even have a lock icon on 10.11.6. Must be in newer versions only?
dmitriid 9y ago
What do you get when you tell everyone that “MacOS and desktop computing are as important to our company as ever” when in reality you barely give a crap about it.
- jtbayly 9y ago
  a cookie. And a raise.
xemplaryx 9y ago
Did apple just fire all their Q&A teams in the past year? So many security and technical problems in their software.
oh-kumudo 9y ago
macOS High Sierra is such a disaster. Did Apple has any quality control over software at this point? No security vending? How could they have customers' trust if they keep making such idiotic mistake?
kylehotchkiss 9y ago
If an Apple developer is reading this, your team should consider system-wide input testing. It'd be worth the developer time. Who knows how things can break if long, crazy strings are inserted.
coverband 9y ago
So basically it's a UI bug, not a serious security vulnerability.
jmull 9y ago
This is a fairly minor bug, since, apparently, it’s only happens when already logged in as admin (and it’s “just” App Store prefs). (I get that you can come up with scenarios to exploit this, but come in.) But, wow, how many bugs is this for High Sierra where a password prompt can be bypassed? It’s like password prompt flu is going around Apple. Was there bad sample code distributed or some change in the default behavior of some key API? (In addition to the obviously inadequate testing.) I guess it would make more sense to me if there was something connecting all these issues. (Besides the inadequate testing.)
dreamfactored 9y ago
So is it that they don't have an automated test suite or the coverage is poor?
bitL 9y ago
Maybe it's Apple's strategy - let macOS slowly disintegrate and then give iOS to frustrated desktop users as the only right way? Last time I've seen that strategy was when Nokia had a mole as CEO installed, though the outcome wasn't very nice to either Nokia nor MS...
anderworx 9y ago
It's a bug. Bugs happen. It will be fixed. Take a deep breath, or a sedative, and relax.
alwillis 9y ago
FYI—I’m running the latest public beta of 10.13.3 (17D34a) and couldn’t duplicate this issue.
Corrado 9y ago
I don't know if I'm doing it wrong or maybe the problem has been fixed in the latest beta, but I can't replicate the problem on 10.13.3 Beta (17D34a). I lock the App Store preference pane and can't unlock it with anything except my real password. And yes, I am logged in as an Admin user.

382 points by tomduncalf 9y ago

Can confirm - with my colleagues laptop - much to his amusement :)

I have a feeling this isn't actually that High Sierra is that much worse, but more that people are now actively pen-testing macOS to find the next embarrassing bug. And that scares me even more because of the unknown of how long such bugs must've existed in the system. Is this Apple's Windows XP moment? (Like when MS stopped everything and did massive security training that resulted in XP SP 2 being worlds more secure?)

CGamesPlay 9y ago
Well, the root account password bug and this bug both do not reproduce on Sierra, so they were both introduced in High Sierra. Unless you’re arguing that Apple fixed a bunch of undisclosed vulnerabilities when they introduced these, High Sierra is definitely worse.
gregoriol 9y ago
Most of the recently discussed High Sierra bugs were not there on Sierra, while the features were there, like this one. So it's not that much pen tensting, but Apple making changes and not validating them correctly. Maybe they have their Vista moment with High Sierra, maybe we forgot previous buggy versions.
- xattt 9y ago
  Could this be the result of shifting quality assurance to the general public through public betas?
  - gurkendoktor 9y ago
    For security-related bugs, maybe. When I file bugs with Apple (which I've mostly given up on), they are usually marked as a duplicate of another still-open bug. So it seems that people actually file bugs -- free QA works! -- but there's not enough time to fix them.
rcthompson 9y ago
High Sierra and Sierra both have enough disruptive bugs in them that I had to downgrade my 2012 Macbook Pro to El Capitan, which did not have those bugs. The most notable one for me was the massive regression in video drivers, that not only made many previously smooth-running games unplayable, but also caused several of the ordinary desktop apps I used to become unacceptably slow.
- verisimilitude 9y ago
  For me they broke automount (/etc/auto_master). It just... randomly takes root ownership of my smb shares. So I can't get to them. Then it randomly gives me ownership back. Crazy-making. Writing a Cocoa app right now to watch for kCFURLVolumeIsAutomountedKey errors and fix this bug myself.

qaq 9y ago

Cmon Apple I know security people are in short supply but: A) You have the resources B) This is the type of bug that any semi decent QA process should catch anyway

donatj 9y ago
It seems like the type of bug that there should be a unit test for.

dalemyers 9y ago

The interesting implication from this is that while it works for the App Store preferences, it doesn't work for the others, showing that there is a manual check that each pane is doing. Why aren't all of these calls identical? If each has to be handled manually, it's no wonder that there are bugs like this appearing.

christoph 9y ago
My guess is that the App Store preferences isn't even meant to have the padlock. iCloud prefs doesn't have it, so I can only assume it's there by mistake. If you try the same thing with say "Time & date prefs", it pauses with an incorrect password for a few seconds, then visually shakes indicating it's a wrong password. With the App Store prefs, it just instantly closes the authentication dialog, even with a blank password. I don't really understand the logic as to why some panels in preferences have padlocks and others don't... Why does date/time need admin rights whereas Network (delete/add/reconfigure networking), Internet Accounts (delete/add any accounts?), iCloud (do all manner of things), Time Machine (back a machine up elsewhere?) don't require it?
- ryanianian 9y ago
  It's concerning there's a UI element that displays as a padlock and shows the standard auth dialog but then doesn't actually do any auth. If this is easy to do by mistake, where else is this hiding?
- dkonofalski 9y ago
  I would imagine it's because changing the system date/time could be used nefariously whereas iCloud, Internet Accounts, and Network would all require passwords for the individual accounts/networks to do anything with them.
  - pishpash 9y ago
    Date time manipulation can be used to bypass expired certificates.

jtchang 9y ago

If you read the notes: This only appears to be when logged in as a local admin. Tested with a non-admin account and I cannot unlock the prefpane with incorrect credentials. So basically they are checking to see if you have credentials already. I guess this is a caching issue since you locked it.

oneeyedpigeon 9y ago
That makes an awful lot of sense, in which case the bug is just not checking that the login is 'cached' before displaying the dialog. In a similar vein to another comment, though, why doesn't that dialog detect the state of the 'login cache' consistently across all occurrences?

briandear 9y ago

Kind of a silly title "AppStore Preferences lock is a lie" -- it isn't a "lie" unless Apple intended for it to not lock correctly. But obviously, it's a bug. It isn't like Apple is trying to deceive users. Interesting bug, unnecessarily hyperbolic title for it.

pvg 9y ago
It's supposed to be amusing. Think 'the cake is a lie'.

dcx 9y ago

I'm on 10.12.6 and a local admin account, and it only unlocks to my actual password. That might mean it's a recently-introduced bug (assuming someone else can reproduce my result).

heartbreak 9y ago
It doesn't reproduce for me on 10.12.6 either. It only works on High Sierra (10.13).
- pvg 9y ago
  I can't reproduce it on 10.13.3 Beta (17D29a). So it might have been fixed already.
hitgeek 9y ago
yea, it says 10.13.2. I can't reproduce it on 10.13.1.
spike021 9y ago
Same here.
- teilo 9y ago
  I reproduced it in 10.13.2 on the first try.

dajohnson89 9y ago

sorry if this is a dumb question, but: why is it unreasonable for a local admin to have the power to change AppStore preferences? without knowing much about the osx security model, this sounds like not a big deal?

TheCoreh 9y ago
On OS X, administrative accounts still need to authenticate with their passwords to perform administrative tasks. This is to avoid (presumably) someone using your computer and changing settings without your consent if you have automatic login enabled, and to make sure you pay attention to what you're doing (similar to the UAC prompts on Windows, and sudo on Windows)
- TheCoreh 9y ago
  I can no longer edit the comment above, but I meant sudo on linux, not on Windows.
gregoriol 9y ago
As long as a password is requested, it has to be checked! Also this wasn't possible on Sierra.
aetherson 9y ago
For certain features, they want you to reconfirm that the user presently at the keyboard is the real admin at the moment that you do it. This prevents a situation where the actual admin logs in, their attention is taken away from the computer, and someone sits at their chair and does awful things with the computer.
- oneeyedpigeon 9y ago
  > For certain features, they want you to reconfirm that the user presently at the keyboard is the real admin at the moment that you do it. If that's the case, no-one told the `sudo` command...

jaimehrubiks 9y ago

Can confirm it doesn't work on "Sierra", so it must be high sierra's feature.

newscracker 9y ago

This does not help at all for the drubbing that macOS High Sierra has been getting recently. Long term OS X users have been waiting for a Snow Leopard like release, but it seems like Apple isn’t taking as much care as required on security and stability on the Mac. Something has to give — either Apple’s organizational structure needs a change or Apple needs to abandon certain things completely instead of releasing sub-standard products that aren’t expected from it. As a long time Mac user, I keep hoping that Apple will decide to double down on better and deeper focus on all its products, including the Mac, its OS and ecosystem, and make the changes necessary across its organization and its teams.

jezfromfuture 9y ago
Snow leopard wasn’t all that till it got a few updates either
- nolok 9y ago
  Didn't use OSX back then, but I think there is a good distance between "not all that" and the security fiasco going on with High Sierra.
  - whhwer823 9y ago
    Security fiascos that most of the time, required one have physical access to the machine in many cases (discounting the recent discovery of Intel bugs). In which case you're screwed anyway. Remember Windows track record as a Swiss cheese POS? They took the complaints, did work to better monitor for issues, now it's a privacy invasion! And how you could basically crack a Mac too, but no one noticed because they weren't as ubiquitous? Selective memory is thing in IT communities. Forgetting that forehead smacking security issues have always been here. Put a Windows XP box online pre-sp1 and instantly get hit with RPC attacks. 'Net security only became a concern for companies in the last decade. And they're still terrible. There are still boxes of disks and tapes being stolen, along with Intel-like bugs we'll never find. But yeah, I'm sure soon we'll figure these all out. Any day now. Just accept it's lowest common denominator engineering and chill.

jaclaz 9y ago

Though it is "queer", it doesn't seem to be that much a security issue, or - more probably - I am failing to understand the risk implied. Can anyone describe a possible scenario where this would pose a security risk?

foz 9y ago
A user with access to a mac could enable the option to automatically install macOS updates, which given recent trends, could impose a security risk.
- briandear 9y ago
  > could impose a security risk How? Installing a Mac OS update could be considered a security risk? That makes little sense since the security risks you're alluding to were solved by updates. 10.13.2 partially fixed the Intel problem in December and 10.13.3 will have more fixes. If you were still running 10.13.1, you'd have both the root login bug and the Intel security issues. If you were still running Sierra, keeping Sierra updated results in solving the following security issues: https://support.apple.com/en-us/HT207483 https://support.apple.com/en-us/HT207483 The Mac OS version out right now is more secure than the previous minor or major version. There really isn't any credible evidence to the contrary. It's irresponsible to not update your system. I understand not moving up to a new version of an OS because of compatibility issues (i.e. audio interfaces often are sluggish to update, libraries you need might not work, etc.,) but not updating because of security fears -- that's just ridiculous. 10.13.3 is more secure than 10.12.2. Also, in order to "exploit" the reported bug, you would have to already be signed into the computer AS AN ADMIN. Which means that you could already change the updating behavior. So unless you are sharing your admin login/account with non admin users, the risk you cite is pretty trivial. If you are in a higher risk computing environment, it would be logical that you would sign out of your account after you've finished using the system -- you would essentially have to provide an unauthorized person access to your Mac while you were signed in before this would be an actual threat. That doesn't make the bug less "real," but it does make the real-world security ramifications much less dire than being implied.

slenk 9y ago

My AppStore preferences do not even have a lock icon on 10.11.6. Must be in newer versions only?

dmitriid 9y ago

What do you get when you tell everyone that “MacOS and desktop computing are as important to our company as ever” when in reality you barely give a crap about it.

jtbayly 9y ago
a cookie. And a raise.

xemplaryx 9y ago

Did apple just fire all their Q&A teams in the past year? So many security and technical problems in their software.

oh-kumudo 9y ago

macOS High Sierra is such a disaster. Did Apple has any quality control over software at this point? No security vending? How could they have customers' trust if they keep making such idiotic mistake?

kylehotchkiss 9y ago

If an Apple developer is reading this, your team should consider system-wide input testing. It'd be worth the developer time. Who knows how things can break if long, crazy strings are inserted.

coverband 9y ago

So basically it's a UI bug, not a serious security vulnerability.

jmull 9y ago

This is a fairly minor bug, since, apparently, it’s only happens when already logged in as admin (and it’s “just” App Store prefs). (I get that you can come up with scenarios to exploit this, but come in.) But, wow, how many bugs is this for High Sierra where a password prompt can be bypassed? It’s like password prompt flu is going around Apple. Was there bad sample code distributed or some change in the default behavior of some key API? (In addition to the obviously inadequate testing.) I guess it would make more sense to me if there was something connecting all these issues. (Besides the inadequate testing.)

dreamfactored 9y ago

So is it that they don't have an automated test suite or the coverage is poor?

bitL 9y ago

Maybe it's Apple's strategy - let macOS slowly disintegrate and then give iOS to frustrated desktop users as the only right way? Last time I've seen that strategy was when Nokia had a mole as CEO installed, though the outcome wasn't very nice to either Nokia nor MS...

anderworx 9y ago

It's a bug. Bugs happen. It will be fixed. Take a deep breath, or a sedative, and relax.

alwillis 9y ago

FYI—I’m running the latest public beta of 10.13.3 (17D34a) and couldn’t duplicate this issue.

Corrado 9y ago

I don't know if I'm doing it wrong or maybe the problem has been fixed in the latest beta, but I can't replicate the problem on 10.13.3 Beta (17D34a). I lock the App Store preference pane and can't unlock it with anything except my real password. And yes, I am logged in as an Admin user.