Big Apple Flaw Allows Root Access to Macs without PasswordBig Apple Flaw Allows Root Access to Macs without Password
Vulnerability affects machines running High Sierra operating system.
November 29, 2017
Mac users and administrators need to be on the lookout for compromised machines after a security researcher disclosed late yesterday a big flaw in Apple's macOS High Sierra platform that allows for password-less logins to root accounts. Publicly disclosed by software engineer Lemi Orhan Ergin via Twitter, the flaw allows someone with physical access to the machine to log in as "root" by leaving the password field empty in a System Preferences unlock screen.
This could be particularly thorny for enterprise environments where users might walk away from their machines, leaving them unattended, says John Bambenek, threat research manager for Fidelis Cybersecurity.
"Most times when people are outside corporate environments, they're either using their laptops or they're in their bag with them," he says. "In the corporate environment, you leave your stuff at your desk, insiders could easily start enabling local administrator accounts that then they could use to bypass local access controls on the endpoint."
According to Mike Buckbee, security engineer for Varonis, this flaw provides another reminder that physical access to a machine is still one of the biggest threats to that machine.
"If left for just a few moments in the wrong hands, your device could easily be compromised," he says.
Bambenek says that this flaw might also help enable laptop theft and that even though there's nothing found in the wild just yet, it could also potentially fuel phishing campaigns.
"It's possible to script and create a working exploit to put into a phishing email or a browser-based lure. I don't think anyone has fully operationalized this maliciously in the wild yet, but if that did start happening, cleanup becomes more important," he says. "People will click on dumb things and Mac users have an artificial sense of security."
Early reports indicate that the issue came because the operating system doesn't handle a very specific error condition well; if that holds, Bambenek believes Apple will be able to get a patch out fairly quickly. In the interim, Apple has created a guide for users to work around the problem and mitigate the threat. Once the patch is applied, the trick will be figuring out which machines have had root accounts tampered with maliciously.
"Fixing the code seems pretty straightforward, but the cleanup part is hard," he says. "It's figuring out what to do with all the machines that may have these accounts created. You can't reset the passwords because somebody might legitimately have set the root password."
About the Author(s)
You May Also Like
How to Combat the Latest Cloud Security ThreatsNov 06, 2023
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023
What's In Your Cloud?Nov 30, 2023
Everything You Need to Know About DNS AttacksNov 30, 2023
9 Traits You Need to Succeed as a Cybersecurity Leader
The Ultimate Guide to the CISSP
Protecting Critical Infrastructure: The 2021 Energy, Utilities, and Industrials Cyber Threat Landscape Report
Building Immunity: The 2021 Healthcare and Pharmaceutical Industry Cyber Threat Landscape Report
The Rise of Extended Detection & Response