How to fix the massive macOS root security bug

How to fix the massive macOS root security bug

Even when it's not possible to enter a user name at the main macOS login screen, the flaw can be exploited via the system preferences settings.

The vulnerability does not always work on the first attempt, but simply continuing to click the "Unlock" button with "root" entered as the username and no password provided will eventually unlock the machine.

If you've got a Mac that's running the latest version of macOS High Sierra, you're going to want to keep it in your line of sight. The attacker needs only to head to Users & Groups, click the lock at bottom-left, then try to log in as "root" with no password.

The issue, discovered in the MacOS High Sierra operating system for laptops and desktops that was released in September, allows people to enter the word "root" when prompted for a username, and provide no password when logging on to the device.

Click, then enter an administrator name and password. The good news is that it's simple to patch this hole right now, without waiting for a software update from Apple.




IBT reached out to Apple for comment regarding the discovery of the security vulnerability but did not receive a response at the time of publication. "Never mind one from a security and privacy-conscious company such as Apple", Steve Troughton-Smith, a Mac software developer, wrote on Twitter.

A demonstration of the security flaw.

This is a developing story. As a temporary fix, to prevent the bug from working, we suggest you enable a root account with a password. Then select "Change Root Password..." and choose a strong password, something with many letters and characters that can't be guessed. You can do this from the user login screen.

Currently, there is no official fix from Apple regarding the issue. This will prompt for a password for the Root user account.

Related Articles

  • Industrial strategy boosts university-industry engagement funding

    Industrial strategy boosts university-industry engagement funding

    But the Government's 255-page new strategy said that by 2046, almost 25 per cent of the population will be over 65. Theresa May said the blueprint would help to shape a stronger and fairer economy for decades.
    Amazon Web Services launches platform to build AR, VR and 3D apps

    Amazon Web Services launches platform to build AR, VR and 3D apps

    Once users have built an experience in Sumerian, it can run on hardware such as the HTC Vive , Oculus Rift , and iPhone. In their scene, the post said, developers can add-in a 3D character and customize them for gender, voice, and language.
    Forde: Florida is moving on from Chip Kelly

    Forde: Florida is moving on from Chip Kelly

    The Ducks played in a BCS bowl in each of his four seasons and made the National Championship game following the 2010 season. He won 12 games in each of his last three years with OR and went 10-3 in his first season with the school in 2009.
  • Meghan Markle has met Prince George and Princess Charlotte at Kensington Palace

    Meghan Markle has met Prince George and Princess Charlotte at Kensington Palace

    Kensington Palace said that Windsor Castle, a royal residence west of London, had become "a special place" for the couple. The bride-to-be will also become a United Kingdom citizen but the process could take a number of years.
    Online sales top $5 billion on Black Friday, report shows

    Online sales top $5 billion on Black Friday, report shows

    Fundivo, a small business loan adviser, found that by 2015, 49 percent of Americans said they have shopped on Cyber Monday. Moore said he's done some online shopping, but the allure of in-store-only deals drew him out from behind the computer.
    Gas Prices down 17.4 cents in Lima region

    Gas Prices down 17.4 cents in Lima region

    AAA said Monday that motorists this year are expected to pay the highest November and December gas prices since 2014. This December drivers will not find significant savings at the gas pump but, AAA says, early 2018 looks promising.
  • Massage Envy facing scores of assault allegations

    Massage Envy facing scores of assault allegations

    None of the reported allegations involve any Massage Envy stores in North Texas. This is not a criminal charge, but Wilson's license has been revoked.
    Time Magazine to be sold in for $2.8 million

    Time Magazine to be sold in for $2.8 million

    Among the funds financing the purchase are $650 million from Koch Equity Development, a fund belonging to Charles and David Koch . The publisher of Time, People and Sports Illustrated agreed Sunday to be sold to another big magazine publisher, Meredith.
    South Africa wins Miss Universe 2017

    South Africa wins Miss Universe 2017

    ABC's America's Funniest Videos (5.3 mil/1.2) saw its best numbers all season, while Shark Tank (4.1 mil/1.0) was up a tenth. Harvey, a five-time Emmy Award victor , mentioned the moment from when he announced the wrong victor at 2015 Miss Universe.
  • Denver to Face Cal Poly in First Round of NCAA Tournament

    Denver to Face Cal Poly in First Round of NCAA Tournament

    Denver has made the tournament the last four years, previously facing Stanford, Washington and Colorado State in the first round. Creighton is the No. 9 national seed and owns a 25-6 overall record as the Big EAST regular season and tournament champion.
    Klopp: It would be 'crazy' to think about Man City

    Klopp: It would be 'crazy' to think about Man City

    He was not happy and said to me, 'Mo (Salah) wanted to come in the position.' But Mo already had 90 minutes in his legs. In the first half, we were very solid and always unsafe when we had the ball.
    Derrick Rose away from Cavs, evaluating career as injuries take mental toll

    Derrick Rose away from Cavs, evaluating career as injuries take mental toll

    League sources say there is uncertainly inside and outside the franchise on whether he'll return to the Cavs. Now, according to ESPN's Nick DePaula , if Rose hangs 'em up, he could save Adidas up to $80 million.