Serious flaw in Apple's MacOS allows any user to gain full root access

Anyone who can click a few buttons and type "root" can get admin access to Apple machines running High Sierra.

UPDATE, 11/29/17: Apple has issued an update that removes the bug from High Sierra.

The original story can be found below.

A new flaw discovered in Apple’s MacOS gives users a remarkably easy way to gain root access on machines.

The bug, discovered Tuesday, allows people to bypass administrative accounts when trying to access various system preferences, such as network or privacy settings. When prompted to enter administrator credentials, a user can enter the username “root,” leave the password blank, and be granted access to the locked menus. The bug only activates after users attempt to sign in via the “root” name multiple times.

Lemi Orhan Emrin, a Turkish software engineer, first announced the bug in a tweet on Tuesday.

CyberScoop editors reproduced the bug multiple times on their machines. Multiple security researchers CyberScoop reached out to also were able to replicate the bug on machines running High Sierra.

In order to exploit the bug, a user would need to have physical access to the machine. Multiple researchers told CyberScoop that until Apple patches the bug, users could set a password for an account named “root.”

“The only silver lining here is that thus far this appears to require local access to the system, so hackers across the world won’t be using it to break down your door,” said Ben Johnson, CTO of California-based Obsidian Security. “Still, anyone with a Mac needs to keep an eye on soon forthcoming updates and patches.”

It’s unknown if the bug exists on previous versions of MacOS.

The flaw is similar to one Apple patched earlier this year: If a user set up a password hint while creating an encrypted volume in Apple’s File System, the password itself was stored as the hint.

Apple released a statement Tuesday, saying it will issue a software update to remove the bug.

UPDATE: Shortly after this story published, Fidelis researcher John Bambenek confirmed that the root/no password combination could be used to access machines running High Sierra through Apple’s native screen sharing client.

https://twitter.com/bambenek/status/935628229779566592

CyberScoop was able to replicate this sort of attack with a free VNC client and a local IP address.

According to a search on Shodan, there are over 84,000 machines openly running Apple’s native screen sharing app.

To turn it off: Go to “System Preferences” and select “Sharing” (its icon is blue folder with a yellow warning sign).  In the left-hand column, turn screen sharing off by clicking the check mark next to “screen sharing.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure