A serious security flaw was found in the latest version of Apple’s macOS High Sierra that could allow anyone to access locked settings on a Mac using the user name “root” and no password, and subsequently unlock the computer.
The security flaw, discovered a couple of weeks ago and disclosed in an Apple developer support forum, has been shown to work within the software’s user preferences screen, among other locations. Once triggered, the same combination will also bypass the lock screen of Macs running Apple’s latest operating system.
Having advised users to set a root password to prevent unauthorised access to Mac computers, the company then pushed out a software update for macOS High Sierra fixing the security flaw on Wednesday afternoon.
Turkish software developer, Lemi Orhan Ergin, publicised the flaw on Twitter, calling the bug a “huge security issue”:
You can access it via System Preferences>Users & Groups>Click the lock to make changes. Then use "root" with no password. And try it for several times. Result is unbelievable! pic.twitter.com/m11qrEvECs
— Lemi Orhan Ergin (@lemiorhan) November 28, 2017
The bug did not affect previous versions of macOS, including Sierra, El Capitan or older. It can reportedly be exploited on an unlocked Mac, bypassing security settings and allowing things such as File Vault encryption and the firewall to be turned off. It can also be exploited at the login screen of a locked Mac – even after a reboot – if the bug has been used before, and in some cases remotely if a user has screen sharing enabled.
If certain sharing services enabled on target - this attack appears to work 💯 remote 🙈💀☠️ (the login attempt enables/creates the root account with blank pw) Oh Apple 🍎😷🤒🤕 pic.twitter.com/lbhzWZLk4v
— patrick wardle (@patrickwardle) November 28, 2017
‘This is really REALLY bad’
The security flaw was originally detailed as a solution to a user login problem on Apple’s developer support forum. A developer called Chethan Kamath, writing under the username chethan177, wrote on 13 November: “On startup, click on “Other”. Enter username: root and leave the password empty. Press enter. (Try twice). If you’re able to log in (hurray, you’re the admin now).”
The solution was then followed by exclaims of surprise that Apple’s software permitted such an action. CoyoteDen said: “Oh my god that should not work, but it does. This is really REALLY bad. Some bug in authentication is ENABLING root with no password the first time it fails!”
Security experts warned that the security hole was both embarrassing for the company and dangerous, allowing anyone with physical access – and in some instances remote access – to a Mac computer to gain full access to user data.
Edward Snowden commented on the bug saying: “Imagine a locked door, but if you just keep trying the handle, it says “oh well” and lets you in without a key.”
Experts also warn against trying out the bug for yourself, as once enabled the flaw can then be more easily exploited even on a locked Mac.
“By testing this vulnerability on your own computer, you’ll end up creating (or modifying) a persistent root user account on your system. The danger here is that, by creating such an account, it will affect remotely accessible services such as Remote Desktop,” Keith Hoodlet, a security engineer at Bugcrowd told CSO.
An Apple spokesperson said the company’s security engineers were notified Tuesday afternoon, releasing an update to close the security hole by 4pm in the UK on Wednesday, which will automatically be installed on affected Mac computers.
“Security is a top priority for every Apple product, and regrettably we stumbled with this release of macOS,” Apple said. “We greatly regret this error and we apologise to all Mac users, both for releasing with this vulnerability and for the concern it has caused. Our customers deserve better. We are auditing our development processes to help prevent this from happening again.”