Apple flaw allows MacOS High Sierra logins without passwords

-
The latest version of Apple’s software has a glaring hole in it: You can log in with just the username "root."

It turns out you don't need a password to log in to a locked Apple device using MacOS High Sierra -- just the username "root."


By heading to your device's System Preferences, under Users & Groups, you can click on the lock and get hit with a prompt asking for a username and password to change settings. Then, instead of entering a password, you can type in "root" for the username and leave the password field empty.

Demonstration


After clicking unlock several times, it should eventually open up, no passwords necessary. Lemi Orhan Ergin, the founder of Software Craftsmanship Turkey, discovered the security flaw and tweeted it out to Apple Support on Tuesday.



"We are working on a software update to address this issue," an Apple spokesperson said. "In the meantime, setting a root password prevents unauthorized access to your Mac. To enable the Root User and set a password, please follow the instructions here. If a Root User is already enabled, to ensure a blank password is not set, please follow the instructions from the 'Change the root password' section."

The simple exploit means anybody with physical access to your MacOS High Sierra device can log in on your computer, no matter how secure your passwords are.

Amit Serper, a security researcher from Cybereason, demonstrated that the bug works even on the login screen after restarting the computer:

The bug works for every aspect of the OS that would normally require a password, which means someone could also get access to your Keychain, containing all your passwords.

MacOS High Sierra was also plagued with a password issue when it launched, after a former NSA hacker showed that he could extract sensitive data from Keychain using an app downloaded online.

There's a workaround for the "root" flaw until Apple fixes it. You can turn guest users off, or change the root password from your directory utility, as 9to5Mac suggested.

How to secure your device?

Apple has already rolled out an update for it. But for the time being, if you haven't got the update you can do this simple trick to fix it. Create a username "root" and set a password to it.

Source: CNET

Comments

Post a Comment

Popular posts from this blog

How to verify your downloaded files using MD5 Checksum on Windows?

-
Image
MD5 stands for Message Digest version 5 . The MD5 algorithm takes a file (the “message”) of any size, and reduces it down to a code that looks like this: “ac30ce5b07b0018d65203fbc680968f5″ (the “digest”). The brilliant thing about the MD5 algorithm is that if the message changes by so much as a single byte, it will produce a completely different digest. An MD5 sum is a string of letters and numbers that acts like a fingerprint for a file. If two files have the same MD5 sum, the files are exactly alike - which is why MD5 "fingerprints" can verify whether or not your downloaded file got corrupted in transit, hence it is used to verify the integrity of files, as virtually any change to a file will cause its MD5 hash to change. MD5 digests have been widely used in the software world to provide some assurance that a transferred file has arrived intact. For example, file servers often provide a pre-computed MD5 (known as md5sum) checksum for the files, so that a user can compare th...
Read more

The World of Technology

-
Image
Without technology, our lives wouldn't be just the usual walk in the park daily routine. Technology is a huge contributor to the well being of human kind. Just try to imagine how hard it would be to make it through the day without the simplest of technologies. We have grown by using the luxuries that technology provides that many wouldn't know how to adapt to the traditional and simpler methods. Technology has surely proven itself to be very beneficial, if not necessary. Some people may be confused on what exactly technology is? Technology is the systematic study of the methods and techniques employed in industry, research, agriculture, and commerce. These studies are then put to use in order to make daily life much easier. Some might think that technology is not necessary due to the opinion that it brings out the worst in people. The earliest technologies of all time are said to be made during the Paleolithic Era. When these technologies were made, language was a key factor in...
Read more

How to check your anti-virus is working or not using anti-malware testfile?

-
Image
Say, you want to test your anti-virus program on your PC. Using real viruses for testing in the real world is rather like setting fire to the dustbin in your office to see whether the smoke detector is working. Such a test will give meaningful results, but with unappealing, unacceptable risks. Since it is unacceptable for you to send out real viruses for test or demonstration purposes, you need a file that can safely be passed around and which is obviously non-viral, but which your anti-virus software will react to as if it were a virus. The good news is that such a test file already exists. A number of anti-virus researchers have already worked together to produce a file that their (and many other) products "detect" as if it were a virus. It's called EICAR.COM anti malware testfile. It is also short and simple - in fact, it consists entirely of printable ASCII characters, so that it can easily be created with a regular text editor. So, without any further ado, lets get d...
Read more