There's a Massive Security Vulnerability in the New macOS

Stillie

Stillie

Expert Member
Joined
Dec 10, 2009
Messages
3,217
Reaction score
308
Location
Cape Town
I found this article and tested it myself,

"In software, there are bugs, and there are dangerous bugs. It looks like macOS High Sierra has one of those dangerous bugs; one that could give someone full access to virtually any user account. And holy buckets, it is scary.

Turkish software developer Lemi Orhan Ergin pointed out an apparent macOS security vulnerability in a tweet on Tuesday afternoon. Basically, if you open System Preferences and then navigate to Users and Groups, you can easily gain access to make changes to any account on that machine. Just click the lock, and when macOS prompts you for a password, replace the user name with “root,” select the password field (but don’t type in a password), and click Unlock. Just like that, the system will unlock. We were able to replicate the issue multiple times. (Seven attempts seems to be the sweet spot.)"


Source:
https://gizmodo.com/theres-a-massive-security-vulnerability-in-the-new-maco-1820810018
 
Just tried it, doesn't work for me.

MacOS High Sierra
Version: 10.13.1 Beta (17B35a)
 
vic777 said:
How so? I am on High Sierra, there are no updates available that I can see to address this?

Edit: I see on Ars there is a patch:
https://support.apple.com/en-us/HT208315

Thanks!
Click to expand...

yea i just saw i got a notification when i started my mac this morning saying that a security patch has been installed, it was installed automatically without my intervention. This MASSIVE (@Lord Farquart :whistle: ) vulnerability has been fixed which is impressive on Apples side.
 
Stillie said:
yea i just saw i got a notification when i started my mac this morning saying that a security patch has been installed, it was installed automatically without my intervention. This MASSIVE (@Lord Farquart :whistle: ) vulnerability has been fixed which is impressive on Apples side.
Click to expand...

I actually checked this morning, saw no patches, read this thread's last replies, checked Ars Techica, saw the new patch had been released, checked again and left the App Store open and after a while the patch was available.

This was a massive flaw in my view. Anyone with physical access to your machine could access it without a password, we checked it on on mac in the office. Great that it got fixed so quickly, but honestly, Apple should pull up their socks and look at their testing and QA - how did something as big as this slip through? Also, so many issues with the touchbar MacBook.
 
Last edited:
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X