Skip to main content
Ask Different

Return to Question

Tweeted twitter.com/askdifferent/status/935869014101970946
removed animated GIF that loops endlessly - added circumstances when this escalation can happen
Source Link
bmike ♦
bmike ♦
  • 241.3k
  • 80
  • 433
  • 958

On 28 November, a root vulnerability was discovered by a user in which the root account can be accessed by entering a blank password. This affects all users.

See theTech Crunch as an animated gif below for proof of conceptshowing how this works if you use an authentication dialog:
proof of concept of root bypass Credit: techcrunch

enter image description here

This flaw is also present on the lock screen, any guest or non-admin accounts as well. Additionally, if there is an 'other' option or you log in with a name and password.

This can also be exploited, through the command line and the Guestvnc/file sharing / screen sharing your root user account, ifcould be enabled with no password to protect access.

How can I protect myself?

On 28 November, a root vulnerability was discovered by a user in which the root account can be accessed by entering a blank password. This affects all users.

See the gif below for proof of concept:
proof of concept of root bypass Credit: techcrunch

This flaw is also present on the lock screen, if there is an 'other' option or you log in with a name and password.

This can also be exploited through the command line and the Guest user account, if enabled.

How can I protect myself?

On 28 November, a root vulnerability was discovered by a user in which the root account can be accessed by entering a blank password. This affects all users.

Tech Crunch as an animated gif showing how this works if you use an authentication dialog:

enter image description here

This flaw is also present on the lock screen, any guest or non-admin accounts as well. Additionally, if there is an 'other' option or you log in, through vnc/file sharing / screen sharing your root user could be enabled with no password to protect access.

How can I protect myself?

Source Link
jacksonwelsh
jacksonwelsh
  • 3k
  • 3
  • 21
  • 44

How do I protect myself from the root vulnerability in macOS High Sierra?

On 28 November, a root vulnerability was discovered by a user in which the root account can be accessed by entering a blank password. This affects all users.

See the gif below for proof of concept:
proof of concept of root bypass Credit: techcrunch

This flaw is also present on the lock screen, if there is an 'other' option or you log in with a name and password.

This can also be exploited through the command line and the Guest user account, if enabled.

How can I protect myself?