Apple Fixes Serious MacOS Password Bug

UPDATED 30/11/2017: Apple has issued a patch for a serious vulnerability with its new Mac OS High Sierra operating system.

The flaw is so serious, it could allow admin access to Apple Macs by using the username ‘root’ and no password, which bypasses (in some cases remotely) local security settings.

It is recommended that Mac users running MacOS High Sierra download ‘Security Update 2017-001’ immediately. Users of older versions of the operating system are not affected.

The bug became public knowledge earlier this week, however the Turkish software developer, Lemi Orhan Ergin did not follow responsible disclosure protocols (by alerting Apple beforehand and giving it chance to fix it) and instead decided to publicise it on Twitter.

Admin Privileges

That said, the flaw was apparently discovered a few weeks ago by a developer called Chethan Kamath (chethan177) and was disclosed in an Apple developer support forum, located here.

But Ergin has done Apple no favours when he decided to use Twitter to draw attention to the flaw in a public forum.

“Dear @AppleSupport, we noticed a *HUGE* security issue at MacOS High Sierra,” he tweeted. “Anyone can login as “root” with empty password after clicking on login button several times. Are you aware of it @Apple?”

Apple started work on an emergency patch, and advised users in the meantime to set a root password.

The Root password flaw can be exploited on any unlocked Mac with the latest Mac OS installed. It can also be exploited at the login screen of a locked Mac (even after a reboot), providing the flaw has been used before.

The flaw can also been exploited remotely if a user has screen sharing enabled.

Does IoT security concern you?

  • Yes (89%)
  • No (11%)

Loading ...

Apple Security

The fact that Apple has let slipped such an obvious security vulnerability will no doubt cause red faces at Apple. And this is not the first bug discovered in macOS High Sierra operating system.

In October a flaw was discovered that could have allowed anyone to gain access to encrypted hard disk volumes. That issue meant that when a user requested a password hint for certain encrypted volumes the operating system instead displayed the entire password.

Yet despite this, Apple has enjoyed a good security reputation for many years, although flaws, bugs and vulnerabilities are increasingly being discovered and patched.

But the fact that Apple’s testing procedures did not detect this latest and fairly obvious root bug before the OS was released does raise some questions of its testing process. As does the fact that the developer Chethan Kamath first exposed this flaw on 13 November on Apple’s own developer forums.

This also leads to questions as to why Apple doesn’t seem to read or monitor the content on its developers forums.

“This is a very surprising bug that evaded the quality control on MacOS High Sierra,” said Tyler Moffitt, Senior Threat Research Analyst at Webroot.

“Apparently, this also works on FileVault in the MacOS which makes this bug quite devastating. The good news is that as of right now, there is not any mention of malware that leverages this security flaw,” he added.

Do you know all about security in 2017? Try our quiz!

Tom Jowitt

Tom Jowitt is a leading British tech freelancer and long standing contributor to Silicon UK. He is also a bit of a Lord of the Rings nut...

Recent Posts

Meta Building Fastest AI Supercomputer In The World

Facebook building the world’s fastest AI supercomputer to help detect and moderate offensive posts and…

45 mins ago

Nvidia Preparing To Abandon $40bn ARM Acquisition – Report

Facing many regulatory probes and lawsuits, Nvidia tells its partners it is preparing to abandon…

3 hours ago

Vodafone To Switch Off 3G Network Next Year

Mobile operators press ahead with early retirement of old networks, as Vodafone sets 2023 deadline…

4 hours ago

Online Safety Bill Is A ‘Missed Opportunity,’ MPs Warn

DCMS committee says draft version of landmark online safety bill is not robust or clear…

6 hours ago

Julian Assange Wins Right To Ask Supreme Court For Extradition Appeal

Another twist. Julian Assange wins right to ask UK's Supreme Court if it will hear…

6 hours ago

ICO Disagrees With Government-Backed Encryption Campaign

UK data protection watchdog, the ICO, says encryption provides protections for children, after government-backed campaign…

7 hours ago