Pro tip: You can log into macOS High Sierra as root with no password

Apple, this is Windows 95 bad – but there is a workaround to kill the bug

Updated A trivial-to-exploit flaw in macOS High Sierra, aka macOS 10.13, allows users to gain admin rights, or log in as root, without a password.

The security bug can be triggered via the authentication dialog box in Apple's operating system, which prompts you for an administrator's username and password when you need to do stuff like configure privacy and network settings.

If you type in "root" as the username, leave the password box blank, hit "enter" and then click on unlock a few times, the prompt disappears and, congrats, you now have admin rights. You can do this from the user login screen, too.

The vulnerability effectively allows someone with physical access to the machine to log in, cause extra mischief, install malware, and so on. You should not leave your vulnerable Mac unattended, nor allow remote desktop access, until you can fix the problem.

And while obviously this situation is not the end of the world – it's certainly far from a true remote hole or a disk decryption technique – it's just really, really sad to see megabucks Apple drop the ball like this.

Developer Lemi Orhan Ergan alerted the wider world to the flaw via Twitter in the past hour or so. The security hole was also quietly discussed on Apple's developer forums two weeks ago, but virtually no one seemed to notice.

It gets worse. You can use this programming blunder to disable FileVault...

But there is a workaround for now. If you have configured a root password, the above blank password trick will not work. So, set a root password right now using...

sudo passwd -u root

El Reg was able to replay the bug on our office Macs running High Sierra, which was released in September. A spokesperson for Apple was not immediately available for comment. Apparently, it's all due to the operating system accidentally creating a blank root account:

Chalk this up as just the latest embarrassing flaw in Apple's newest flavor of macOS, the OS formerly known as OS X. In October, fans noted that High Sierra would also do things like disclose the password for encrypted drives, and cough up account credentials to untrusted applications.

Earlier builds of the OS also had a habit of ruining the hard drives in iMacs, and rendering kernel-level security protections effectively useless, thanks to buggy code implementations.

Let's hope Apple engineers can do a bit better with next year's release, or we may all be left hoping for that iOS to Mac conversion sooner than later. We'll update this article as and when new information arrives. The latest High Sierra beta release is not affected, apparently. ®

Updated to add

Apple has just now published this handy guide to enabling the root account and setting a non-blank password for it, which defeats the above exploit.

And to reiterate, watch out if you have remote desktop access switched on for your Mac – VNC, RDP, screen sharing and similar can be used to gain admin rights on your computer via this vulnerability. So set a root password for now, and don't forget it.

Apple is working on a software patch to correct the issue – which is good news because the bug can be triggered via the command line and not just the interactive GUI. This means malware and naughty apps can now automatically and silently grab root privileges on High Sierra Macs, allowing them to cause real damage.

Similar topics

Other stories you might like

  • We sat through Apple's product launch disguised as a dev event so you don't have to
    M2 chip teased plus MacBooks, iOS 16, macOS 13, watchOS 9 and more

    WWDC Apple opened its 33rd annual Worldwide Developer Conference on Monday with a preview of upcoming hardware and planned changes in its mobile, desktop, and wrist accessory operating systems.

    The confab consists primarily of streamed video, as it did in 2020 and 2021, though there is a limited in-person component for the favored few. Apart from the preview of Apple's homegrown Arm-compatible M2 chip – coming next month in a redesigned MacBook Air and 13" MacBook Pro – there was not much meaningful innovation. The M2 Air has a full-size touch ID button, apparently.

    Apple's software-oriented enhancements consist mainly of worthy but not particularly thrilling interface and workflow improvements, alongside a handful of useful APIs and personalization capabilities. Company video performers made no mention of Apple's anticipated AR/VR headset.

    Continue reading
  • Apple offers improved Linux support in macOS Ventura
    Penguin fans will be able to use Rosetta 2 to run x86 binaries in forthcoming update

    Apple is extending support for its Rosetta 2 x86-64-to-Arm binary translator to Linux VMs running under the forthcoming macOS 13, codenamed Ventura.

    The next version of macOS was announced at Apple's World Wide Developer Conference on Monday, and the new release has a number of changes that will be significant to Linux users. The company has disclosed the system requirements for the beta OS, which you can read on the preview page.

    One level of Linux relevance is that macOS 13 still supports Intel-based Macs, but only recent ones, made in 2017 and later. So owners of older machines – including the author – will soon be cut off. Some will run Windows on them via Bootcamp, but others will, of course, turn to Linux.

    Continue reading
  • Workers win vote to form first-ever US Apple Store union
    Results set to be ratified by labor board by end of the week

    Workers at an Apple Store in Towson, Maryland have voted to form a union, making them the first of the iGiant's retail staff to do so in the United States.

    Out of 110 eligible voters, 65 employees voted in support of unionization versus 33 who voted against it. The organizing committee, known as the Coalition of Organized Retail Employees (CORE), has now filed to certify the results with America's National Labor Relations Board. Members joining this first-ever US Apple Store union will be represented by the International Association of Machinists and Aerospace Workers (IAM).

    "I applaud the courage displayed by CORE members at the Apple store in Towson for achieving this historic victory," IAM's international president Robert Martinez Jr said in a statement on Saturday. "They made a huge sacrifice for thousands of Apple employees across the nation who had all eyes on this election."

    Continue reading

Biting the hand that feeds IT © 1998–2022