MacOS High Sierra bug allows full admin access without a password

Lemi Orhan Ergin on Twitter:

All someone needs to do is change "username" to "root", leave the password blank, and press the "unlock" button multiple times.

The current release of macOS High Sierra, version 10.13.1, has a bug that allows someone with physical access to your machine to bypass the log-in screen and access your data.

Business Insider was able to replicate the bug on Tuesday. We've reached out to Apple for comment and will update it we hear back. MacOS users may want to mitigate the issue themselves by assigning a root password or disabling the root account in System Preferences - User Groups on your Mac device. Select Open Directory Utility click the lock icon in the Directory Utility window then enter your admin name and password again.

A demonstration of the security flaw.




It's not clear if Apple was made aware of the problem before it was publicly disclosed.

If a bad actor exploited this security bug, they'd get System Administrator access - meaning that person could read and write over virtually any part of the computer system, including files in other macOS user accounts. Then from the menu bar at the top of the screen, click on the "Edit" menu and choose "Enable Root User". After signing in as a guest, it was possible to change security settings and install apps and software updates from the Mac App Store, just by typing the user name "root". This is a level of access that is well in excess of a normal admin account that is created when adding users on a Mac. Click "Login Options", then click "Join", which appears next to the text "Network Account Server".

Let's make this clear: this is a huge mistake on Apple's part, even if there's a relatively simple fix. This will prompt for a password for the Root user account. But The Verge offered a solution: Create a new system administrator password.

Related news:

Hot News

isis-killer-beheading-video-story-top Meghan Markle has met Prince George and Princess Charlotte at Kensington Palace
Nov 29, 2017 - 01:08
They will visit Nottingham, where Prince Harry started the Full Effect programme in 2014 through The Royal Foundation. Markle have regularly spent time there over the previous year and a half", Kensington Palace said in a statement.

isis-killer-beheading-video-story-top Melania Trump unveils annual White House Christmas decorations
Nov 29, 2017 - 01:08
People on Twitter are mincing no words in revealing their dread on seeing the way the White House is decking up for Christmas . Ivana Trump , Donald Trump's first wife, also stated that the reluctance extends to the president himself.

isis-killer-beheading-video-story-top 'Black Friday' in United States brings great news for global e-commerce
Nov 29, 2017 - 01:05
Sears Holdings Corp. saw same-store sales fall 17 percent at its flagship chain last quarter and 13 percent at its Kmart brand. That nearly certainly front-loaded some brick-and-mortar sales that may otherwise have occurred over the Thanksgiving weekend.

isis-killer-beheading-video-story-top Manchester United striker Romelu Lukaku avoids Premier League suspension
Nov 28, 2017 - 01:25
As a result, a panel of three former elite referees reviewed the footage independently of one another to advise whether they deemed it a sending off offence.

isis-killer-beheading-video-story-top Florida finalizing deal with Dan Mullen
Nov 28, 2017 - 01:05
Before Mullen's arrival in 2009, Mississippi State had seasons with at least eight losses in seven of the previous eight years. When the Bulldogs receive a bowl invitation next week, it will be their eighth under Mullen.

isis-killer-beheading-video-story-top Pep Guardiola plays down chances of Manchester City going unbeaten all season
Nov 27, 2017 - 01:52
That is so important because when you win sometimes other people are happier but that is not reality in the high level of sport. If you ask me that question next week I can give you a more honest view.

isis-killer-beheading-video-story-top Klopp: It would be 'crazy' to think about Man City
Nov 27, 2017 - 01:47
However, the north London side will regard the 1-1 stalemate with the strugglers at Wembley as two points dropped. The striker outmuscled Spurs defender Davinson Sanchez and rolled a shot past Hugo Lloris.

isis-killer-beheading-video-story-top Trump criticizes CNN for 'representing U.S. poorly to the world'
Nov 27, 2017 - 01:37
As former FBI Director James Comey reminds us, freedom of the press has always been an important part of American democracy. Soon thereafter several of CNN's top journalists came to the defence of their colleagues in their worldwide wing.

isis-killer-beheading-video-story-top UCLA Hires Chip Kelly As Head Football Coach
Nov 27, 2017 - 01:30
UCLA fired Jim Mora after the Bruins lost to crosstown rival USC in their last away game of the season. He proceeded to go just 6-9 in his third year and was sacked before the last week of the campaign.

isis-killer-beheading-video-story-top Doctor Who: Shada on iTunes - iTunes
Nov 27, 2017 - 01:23
Trouble begins when Skagra (from the planet Dronoid) resolves to visit Shada , where he will extract inmates' felonious knowledge. The original episode was scrapped after a BBC strike, but not before seven hours of filming for the show had been completed.

isis-killer-beheading-video-story-top Man fleeing police charged after vehicle fatally strikes deputy
Nov 26, 2017 - 01:48
After Berak's vehicle struck Deputy Overall, the suspect's auto rolled over and Berak was arrested on-scene. Doors open at 9:30 a.m. "Our deputies at the time of this don't even know that he's there".

isis-killer-beheading-video-story-top NBA Predictions: Spurs vs. Hornets 11/25/17
Nov 26, 2017 - 01:41
They lead the series against Charlotte 40-15 and are 4-1 in their last five road games against the Hornets . He switched from yellow to black shoes after scoring six points in the first half.

isis-killer-beheading-video-story-top Gabby Douglas Releases New Statement on Abuse Allegations Against Larry Nassar
Nov 26, 2017 - 01:37
For all those involved, and - that I'm so horribly sorry that this was like a match that turned into a forest fire out of control. The governing organization, USA Gymnastics, claims they didn't know of Nassar's repulsive behavior until the year he was sacked .

isis-killer-beheading-video-story-top Texas Tech defeats Texas 27-23
Nov 26, 2017 - 01:34
Parker said the Raiders had been playing zone, but changed to man coverage to trick Ehlinger into a bad read. In five years, Kingsbury is 30-32, including two seasons in which he finished with a losing record.

isis-killer-beheading-video-story-top Uttar Pradesh Train Derailment Updates: 3 People Dead 9 Injured
Nov 26, 2017 - 01:30
Sources in the Railway Ministry hinted that assessment by officials placed the blame on rail fracture leading to the accident. The accident which occurred at the Manikpur station in Chitrakoot district of Uttar Pradesh.