An open community 
of Macintosh users,
for Macintosh users.

FineTunedMac Dashboard widget now available! Download Here

Previous Thread
Next Thread
Print Thread
high sierra, everyone's root!
#47053 11/28/17 08:39 PM
Joined: Aug 2009
OP Offline

Joined: Aug 2009


I work for the Department of Redundancy Department
Re: high sierra, everyone's root!
Virtual1 #47054 11/28/17 11:57 PM
Joined: Aug 2009
Likes: 7
Online

Joined: Aug 2009
Likes: 7


Jon

macOS 11.7.10, iMac Retina 5K 27-inch, late 2014, 3.5 GHz Intel Core i5, 1 TB fusion drive, 16 GB RAM, Epson SureColor P600, Photoshop CC, Lightroom CC, MS Office 365
Re: high sierra, everyone's root!
jchuzi #47055 11/29/17 12:27 AM
Joined: Aug 2009
Offline

Joined: Aug 2009
iMore provides instructions on setting the root password, which eliminates the issue.

Link: Setting root Password


MacStudio M1max - 14.4.1, 64 GB Ram, 4TB SSD; Studio Display; iPhone 13mini; Watch 9; iPadPro (M2) 11" WiFi
Re: high sierra, everyone's root!
pbGuy #47056 11/29/17 12:42 PM
Joined: Aug 2009
Offline

Joined: Aug 2009
Is physical access required or can Remote Access also exploit this vulnerability?


Harv
27" i7 iMac (10.13.6), iPhone Xs Max (12.1)

Those who can make you believe absurdities can make you commit atrocities. ~Voltaire
Re: high sierra, everyone's root!
Pendragon #47057 11/29/17 01:57 PM
Joined: Aug 2009
Offline

Joined: Aug 2009
Good question. ...According to the guy, who discovered this issue, physical access is required.

However, Apple details (at the Support Page linked below) that root user is disabled by default; but, if one logs in to one's Mac using an administrator account, one could enable the root user, then log in as the root user to complete a task. ...Again, I'm not sure is this could be done remotely (with administrator login password).

Here's Apple's root PW Instructions

Regardless, setting a root user password (a strong & unique one) would defeat this security issue. (My unique, root PW is a 13 alpha-numeric-character PW I'll never remember; so, I saved it to 1PW.)

I used the "Change root password" method within System Preferences (as iMore detailed wherein they advised keeping "Enable root user" - after setting root password - since subsequently disabling will delete the just-initiated password). Done. cool

Last edited by pbGuy; 11/29/17 04:09 PM. Reason: update about access

MacStudio M1max - 14.4.1, 64 GB Ram, 4TB SSD; Studio Display; iPhone 13mini; Watch 9; iPadPro (M2) 11" WiFi
Re: high sierra, everyone's root!
pbGuy #47061 11/29/17 04:08 PM
Joined: Aug 2009
Likes: 7
Online

Joined: Aug 2009
Likes: 7
Apple just issued this security update for High Sierra. From the language, I'm not positive that it addresses the root user issue, but it sounds as if it might.


Jon

macOS 11.7.10, iMac Retina 5K 27-inch, late 2014, 3.5 GHz Intel Core i5, 1 TB fusion drive, 16 GB RAM, Epson SureColor P600, Photoshop CC, Lightroom CC, MS Office 365
Re: high sierra, everyone's root!
jchuzi #47062 11/29/17 04:23 PM
Joined: Aug 2009
Offline

Joined: Aug 2009
I just completed the Security Update (no Restart required), available through Mac Apple Store update. My macOS 10.13.1 build did change to that referenced on the Support page.

Thanks for the link. ...And, I found this sentence ("If you require the root user account on your Mac, you will need to re-enable the root user and change the root user's password after this update.) about the Update, interesting as it implies the update resets the "enable root & its password." ....Hmmm. smirk


MacStudio M1max - 14.4.1, 64 GB Ram, 4TB SSD; Studio Display; iPhone 13mini; Watch 9; iPadPro (M2) 11" WiFi
Re: high sierra, everyone's root!
Pendragon #47066 11/29/17 05:01 PM
Joined: Aug 2009
OP Offline

Joined: Aug 2009
Originally Posted By: Pendragon
Is physical access required or can Remote Access also exploit this vulnerability?

Basically the problem is that before you "enable the root user", he's already there and enabled because he has to be, but can't authenticate by default if his password is blank. except for this one place that someone forgot to lock down in HS.

It does lead me to wonder though, surely they will find the person ultimately responsible for this, I wonder what will happen to them? What is the penalty for a major embarrassment?


I work for the Department of Redundancy Department
Apple to review software practices
Virtual1 #47073 11/29/17 06:23 PM
Joined: Aug 2009
OP Offline

Joined: Aug 2009


I work for the Department of Redundancy Department
Re: high sierra, everyone's root!
pbGuy #47074 11/29/17 06:35 PM
Joined: Aug 2009
Likes: 5
Moderator
Offline
Moderator

Joined: Aug 2009
Likes: 5
Same positive result for the security update here....however, I'm fairly certain that you meant to say that the build for 13.1 did NOT show up after install.

Mine has NO build associated with the Mac OS X 10.13.1 listed under "About This Mac" under the Apple Menu.....

It DID disable the previously enabled root user....and it DID properly test to validate that the previous root bypass issue was resolved....and I was able to re-enable and disable the root user appropriately with both the Terminal and with the Directory Utility.


Freedom is never free....thank a Service member today.
Re: high sierra, everyone's root!
MacManiac #47077 11/29/17 06:47 PM
Joined: Aug 2009
Offline

Joined: Aug 2009
Originally Posted By: MacManiac
...Mine has NO build associated with the Mac OS X 10.13.1 listed under "About This Mac" under the Apple Menu.....


In the "About" window, click on the version number; you'll then see the Build added.

Additionally, you could also use the Sys Info app (Utilities), click on Software. You'll also see the System Version with the Build.


MacStudio M1max - 14.4.1, 64 GB Ram, 4TB SSD; Studio Display; iPhone 13mini; Watch 9; iPadPro (M2) 11" WiFi
Re: high sierra, everyone's root!
pbGuy #47080 11/29/17 11:58 PM
Joined: Aug 2009
Offline

Joined: Aug 2009
Apparently, today's Security Fix causes a problem with File Sharing. See this.

FWIW, I ran the fix and it seems to have worked as divined.


Harv
27" i7 iMac (10.13.6), iPhone Xs Max (12.1)

Those who can make you believe absurdities can make you commit atrocities. ~Voltaire
Re: high sierra, everyone's root!
Pendragon #47081 11/30/17 04:37 AM
Joined: Aug 2009
Likes: 1
Offline

Joined: Aug 2009
Likes: 1
Originally Posted By: Pendragon
Is physical access required or can Remote Access also exploit this vulnerability?


At first, it appeared that physical access was required. It now appears this is not the case. If a user can be tricked into running a malicious app or shell script, the malicious app or shell script can silently enable the root user and then make any changes whatsoever to the system.

You will still need to trick the user into running malicious code, however.



Photo gallery, all about me, and more: www.xeromag.com/franklin.html
Re: high sierra, everyone's root!
pbGuy #47084 11/30/17 06:24 AM
Joined: Aug 2009
Likes: 5
Moderator
Offline
Moderator

Joined: Aug 2009
Likes: 5
Thanks for that....I missed the change in how About This Mac delivered info as obviously it no longer shows the build until you click on the version number.


Freedom is never free....thank a Service member today.
Re: high sierra, everyone's root!
MacManiac #47087 11/30/17 10:30 AM
Joined: Aug 2009
Likes: 7
Online

Joined: Aug 2009
Likes: 7


Jon

macOS 11.7.10, iMac Retina 5K 27-inch, late 2014, 3.5 GHz Intel Core i5, 1 TB fusion drive, 16 GB RAM, Epson SureColor P600, Photoshop CC, Lightroom CC, MS Office 365
Re: high sierra, everyone's root!
jchuzi #47088 11/30/17 01:57 PM
Joined: Aug 2009
Offline

Joined: Aug 2009
The update to the SU update is now available. ...Other than correcting the File Sharing issue, the 10.13.1 Build is now 17B1003.


MacStudio M1max - 14.4.1, 64 GB Ram, 4TB SSD; Studio Display; iPhone 13mini; Watch 9; iPadPro (M2) 11" WiFi
found it!
Virtual1 #47099 11/30/17 06:30 PM
Joined: Aug 2009
OP Offline

Joined: Aug 2009
and this is where it all began, accidentally, WEEKS AGO:

https://forums.developer.apple.com/thread/79235


I work for the Department of Redundancy Department
High Sierra
Virtual1 #47100 11/30/17 07:31 PM
Joined: Aug 2009
Offline

Joined: Aug 2009
My 2¢...

While this coding episode should not have occurred and should be / is an embarrassment to Apple, IMHO, I think those using this episode to voice denigrating comments about High Sierra, are a bit over the mark. (I am not implying any posts in this Thread have done so; but, I have read such shortsighted comments elsewhere.)

Apple deserves a knock for allowing both issues (the High Sierra root vulnerability & the subsequent File Share) to get past code quality control.

Apple reacted quickly to fix both; I think that counts for something. ...Other issues will, no doubt, subsequently arise with macOS (& iOS); I have confidence Apple will be responsive in getting those quickly fixed.

I've been using High Sierra from day one. As my MBP has an SSD, I've using APFS from day one as the upgrade auto converted my drive. ...I've not had any fundamental issues (with Keychain, iCloud, Time Machine, my HS compatible apps, my total system) causing me to even consider rolling back to Sierra. Progress is going forward, not the opposite.

I'm aware some have had certain issues, and FTM is the place to seek help as the active participants are highly knowledgeable & willing to assist. But, again IMHO, I do not believe there are fundamental issues with High Sierra itself, when its installed on a hardware setup that will effectively and efficiently run High Sierra.


MacStudio M1max - 14.4.1, 64 GB Ram, 4TB SSD; Studio Display; iPhone 13mini; Watch 9; iPadPro (M2) 11" WiFi
Re: High Sierra
pbGuy #47101 11/30/17 08:16 PM
Joined: Aug 2009
OP Offline

Joined: Aug 2009
Originally Posted By: pbGuy
Apple deserves a knock for allowing both issues (the High Sierra root vulnerability & the subsequent File Share) to get past code quality control.

And don't forget the file vault storing the password in the hint recently.... there's a reason Apple is calling a meeting with their devs to "discuss recent security".


I work for the Department of Redundancy Department

Moderated by  alternaut, dkmarsh, joemikeb 

Link Copied to Clipboard
Powered by UBB.threads™ PHP Forum Software 7.7.4
(Release build 20200307)
Responsive Width:

PHP: 7.4.33 Page Time: 0.050s Queries: 52 (0.030s) Memory: 0.6693 MB (Peak: 0.7998 MB) Data Comp: Zlib Server Time: 2024-03-28 22:42:16 UTC
Valid HTML 5 and Valid CSS