Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Apple High Sierra Uses a Passwordless Root Account - SANS Internet Storm Center SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Apple High Sierra Uses a Passwordless Root Account

Today, a security researcher twitted[1] about a dangerous behaviour he found in the Apple High Sierra operating system: It is possible to get administrator rights (the "root" account on UNIX) by connecting without a password. I was able to reproduce this behaviour on my MacBook running the latest OS X version. It appears that OS X is delivered with a passwordless root account.

A quick fix is to create a password as soon as possible. Open a terminal and type the following command:

$ sudo passwd root

It's not clear if only High Sierra is affected or also older versions. We will update this post as soon as possible if required.

[1] https://twitter.com/lemiorhan/status/935578694541770752

Xavier Mertens (@xme)
ISC Handler - Freelance Security Consultant
PGP Key

Xme

396 Posts
ISC Handler
I had previously enabled root (on a Macbook Pro) and set a password. This was before updating to High Sierra. In this case the previous root password was still in force after the update (fortunately).
Xme
1 Posts Posts

Sign Up for Free or Log In to start participating in the conversation!