Sci-tech

How to Fix: macOS High Sierra Flaw Allows Admin Access Without Password

How to Fix: macOS High Sierra Flaw Allows Admin Access Without Password

All someone needs to do is change "username" to "root", leave the password blank, and press the "unlock" button multiple times.

It is possible to mitigate against the flaw, however, by adding a password for the root user in the users and groups preferences pane.

In the dialog that pops up, click on open directory utility, and from the tool's menubar, select the edit item, and then change root password. Press Return or click the Unlock button a few times - I've seen it both accept on the first try and require a couple of additional tries. Engadget has confirmed that you can gain root access in the login screen, the System Preferences Users & Groups tab and File Vault with this method.

Indeed, we tested this out on a Mac running 10.13.2 High Sierra - although it should work on the current 10.13.1 build - and it works quite easily.

This is a critical bug that allows anyone on a Mac to log in and change the admin settings - using just the username "root" with no password. You can check your version of macOS by clicking on the Apple logo in the upper lefthand corner of your screen and clicking "About this Mac".

Many people responding to that tweet said they were relieved to learn that this extremely serious oversight by Apple does not appear to be exploitable remotely. That is the full Unix root account, which has superuser privileges that enable it to see and modify any file in any account.

Once in the "Join" menu, click on "Open Directory Utility".

Disabling your computer's root account would not fix the problem, according to several researchers looking into the bug.

Once a password has been set for the "root" account, the flaw that allows a person to login as "root" with no password will no longer work. The bug didn't work on a Mac with older software.


  • Samsung Galaxy J5 Prime (2017) Receives FCC Certification, Hinting Imminent Launch

    Samsung Galaxy J5 Prime (2017) Receives FCC Certification, Hinting Imminent Launch

    Google released Android 7.1 Nougat in December, but the Galaxy S8 and Galaxy S8 Edge both featured Android 7.0 Nougat at launch. Back at the beginning of November, Samsung introduced a brand new color variant of its flagship Galaxy S8 called Burgundy Red.
    Borussia Dortmund close in on deal to score ANOTHER former player

    Borussia Dortmund close in on deal to score ANOTHER former player

    We had unbelievable chances a couple of days ago [against Basel in the Champions League] and we couldn't score, today we did it. Speaking to Telefoot , Anthony said: "I'm someone who does not like talking, I like to stay in my little bubble".
    United Nations  aid workers return to Yemen on first flight to Sanaa

    United Nations aid workers return to Yemen on first flight to Sanaa

    Aid shipments were awaiting delivery for several days in advance, after Saudi leaders agreed on Wednesday to lift the blockade. The UNICEF plane was loaded with urgent relief supplies, while the three others carried aid workers, the official added.
  • Melbourne terror accused faces court

    Melbourne terror accused faces court

    Patton described Ali as "a person who's expressed an intention to try and kill as many people as he could through shooting them". The practising Muslim was born in Australia, is an Australian citizen and his parents were from Somalia, Mr Patton said .
    Bali volcano erupts for second time

    Bali volcano erupts for second time

    It caused several airlines - including, KLM, Qantas, AirAsia, and Virgin - to cancel or rearrange flights in the region. Mount Agung is one of 129 active volcanoes in Indonesia, a vast archipelagic nation with 17,500 islands.
    Texas state trooper shot, killed; suspect apprehended

    Texas state trooper shot, killed; suspect apprehended

    Lindale News and Times stated that Black allegedly crashed into a deputy's auto when he was being chased by Smith County deputies. Waller County authorities said shots were fired, but did not indicate who opened fire.
  • Stokes 'not Australia-bound' after picture suggests Ashes call

    Stokes 'not Australia-bound' after picture suggests Ashes call

    Canterbury Cricket chief executive Jeremy Curwin believes Stokes' flight will arrive in Christchurch today. The England ace remains under investigation after a brawl in Bristol in September.
    Military Must Accept Transgender Troops From 2018, Federal Judge Rules

    Military Must Accept Transgender Troops From 2018, Federal Judge Rules

    The Trump trans military ban issued via Twitter in July 2017 was always based on flimsy reasoning: The U.S. But in July, Trump tweeted that he would reinstate the ban on trans military service.
    QB John O'Korn likely to start for MI  vs

    QB John O'Korn likely to start for MI vs

    Haskins was off the mark with his pass on third-and-five, but a defensive hold gave the Buckeyes an automatic first down. After securing the catch, Baugh turned upfield and scampered his way into the end zone for the game-tying touchdown.
  • Israeli Court Bans Uber Taxi App Over Lack of Insurance for Drivers

    Israeli Court Bans Uber Taxi App Over Lack of Insurance for Drivers

    The court was addressing a lawsuit filed by the Transportation Ministry, which was of the opinion Uber was operating illegally in Israel.
    Young hails Man Utd pal Lindelof: He inspired the crowd

    Young hails Man Utd pal Lindelof: He inspired the crowd

    United have been imperious at Old Trafford, winning all seven Premier League games, scoring 20 goals and conceding just once. Everton lost against Southampton this weekend, while Watford won against Newcastle United in the Premier League .
    Conyers steps aside from top spot on Judiciary

    Conyers steps aside from top spot on Judiciary

    Conyers, 88, denied the allegations in a statement on Sunday , but said he chose to resign due to the ongoing House Ethics Committee investigation.