Major macOS High Sierra Bug Allows Full Admin Access Without Password – How to Fix [Updated]

News
There appears to be a serious bug in macOS High Sierra that enables the root superuser on a Mac with a blank password and no security check.

The bug, discovered by developer Lemi Ergin, lets anyone log into an admin account using the username “root” with no password. This works when attempting to access an administrator’s account on an unlocked Mac, and it also provides access at the login screen of a locked Mac.

To replicate, follow these steps from any kind of Mac account, admin or guest:

1. Open System Preferences

2. Choose Users & Groups

3. Click the lock to make changes

4. Type “root” in the username field

5. Move the mouse to the Password field and click there, but leave it blank

6. Click unlock, and it should allow you full access to add a new administrator account.

At the login screen, you can also use the root trick to gain access to a Mac after the feature has been enabled in System Preferences. At the login screen, click “Other,” and then enter “root” again with no password.

This allows for admin-level access directly from the locked login screen, with the account able to see everything on the computer.

It appears that this bug is present in the current version of macOS High Sierra, 10.13.1, and the macOS 10.13.2 beta that is in testing at the moment. It’s not clear how such a significant bug got past Apple, but it’s likely this is something that the company will immediately address.

Until the issue is fixed, you can enable a root account with a password to prevent the bug from working. We have a full how to with a complete rundown on the steps available here.

Update: An Apple spokesperson told MacRumors that a fix is in the works:

“We are working on a software update to address this issue. In the meantime, setting a root password prevents unauthorized access to your Mac. To enable the Root User and set a password, please follow the instructions here: https://support.apple.com/en-us/HT204012. If a Root User is already enabled, to ensure a blank password is not set, please follow the instructions from the ‘Change the root password’ section.”

Related Roundup: macOS High Sierra

Discuss this article in our forums

Powered by WPeMatico

News
The Rock Is Having Another Baby Rock

Dwayne “The Rock” Johnson is adding another member to his brood, posting on Instagram that he and his partner Lauren Hashian are expecting a baby girl. Read more… Powered by WPeMatico

News
Gizmodo Former Facebook Exec: ‘You Don’t Realize It But You Are Being Programmed’ | Jalopnik Here’s

Gizmodo Former Facebook Exec: ‘You Don’t Realize It But You Are Being Programmed’ | Jalopnik Here’s How Crazy Pricey It Is Just To Keep A McLaren F1 On The Road | Kotaku The State Of The 3DS In 2017 | The Takeout President Trump drinks 12 Diet Cokes a day | Two Cents Pros and …

News
Beyoncé Lawyers Tell Brewery to Stop Selling Bïeryoncé Beer

To the left, to the left, put every single Bïeryoncé beer in a box to the left. Read more… Powered by WPeMatico