Apple flaw allows MacOS High Sierra logins without passwords
The latest version of Apple’s software has a glaring hole in it: You can log in with just the username "root."
CNET independently confirmed that you can log in on MacOS High Sierra with just the username "root."
The username is the "root" of all problems for Apple's latest operating system.
It turns out you don't need a password to log in to a locked Apple device using MacOS High Sierra -- just the username "root."
By heading to your device's System Preferences, under Users & Groups, you can click on the lock and get hit with a prompt asking for a username and password to change settings. Then, instead of entering a password, you can type in "root" for the username and leave the password field empty.
After clicking unlock several times, it should eventually open up, no passwords necessary. Lemi Orhan Ergin, the founder of Software Craftsmanship Turkey, discovered the security flaw and tweeted it out to Apple Support on Tuesday.
Dear @AppleSupport, we noticed a *HUGE* security issue at MacOS High Sierra. Anyone can login as "root" with empty password after clicking on login button several times. Are you aware of it @Apple?
— Lemi Orhan Ergin (@lemiorhan) November 28, 2017
CNET independently confirmed this security flaw exists.
"We are working on a software update to address this issue," an Apple spokesperson said. "In the meantime, setting a root password prevents unauthorized access to your Mac. To enable the Root User and set a password, please follow the instructions here. If a Root User is already enabled, to ensure a blank password is not set, please follow the instructions from the 'Change the root password' section."
The simple exploit means anybody with physical access to your MacOS High Sierra device can log in on your computer, no matter how secure your passwords are.
Amit Serper, a security researcher from Cybereason, demonstrated that the bug works even on the login screen after restarting the computer:
Just tested the apple root login bug. You can log in as root even after the machi was rebooted pic.twitter.com/fTHZ7nkcUp
— Amit Serper (@0xAmit) November 28, 2017
The bug works for every aspect of the OS that would normally require a password, which means someone could also get access to your Keychain, containing all your passwords.
A demonstration of the security flaw.
MacOS High Sierra was also plagued with a password issue when it launched, after a former NSA hacker showed that he could extract sensitive data from Keychain using an app downloaded online.
There's a workaround for the "root" flaw until Apple fixes it. You can turn guest users off, or change the root password from your directory utility, as 9to5Mac suggested.
Kurt Opsahl, the general counsel for the Electronic Frontier Foundation, recommended creating a username "root" and setting a password to solve the blatant issue.
First published Nov. 28, 12:44 p.m PT.
Update, 1:15 p.m. PT: Adds details about how to fix the issue as well as what other things the "root" bug can access. Update, 3:25 p.m. PT: Adds a statement from Apple.
Does the Mac still matter? Apple execs explain why the MacBook Pro was over four years in the making, and why we should care.
Tech Culture: From film and television to social media and games, here's your place for the lighter side of tech.