“Oooh, boy, this is a doozy,” says Reed. “So, if someone did this to a Mac sitting on a desk in an office, they could come back later and do whatever they wanted.” On Wednesday, about 18 hours after the bug was widely publicized, Apple announced a security …
mac hacker – read more
Enlarge (credit: Andrew Cunningham)
The serious and surprising root security bug in macOS High Sierra is back for some users, shortly after Apple declared it fixed. Users who had not installed macOS 10.13.1 (and thus were running a prior version of the OS when they received the security update) found that installing 10.13.1 resurfaced the bug, according to a report from Wired.
For these users, the security update can be installed again (in fact, it would be automatically installed at some point) after updating to the new version of the operating system. However, the bug is not fixed in that case until the user reboots the computer. Many users do not reboot their computers for days or even weeks at a time, and Apple’s support documentation did not, at first, inform users that they needed to reboot. So some people may have been left vulnerable without realizing it. The documentation has been updated with the reboot step now.
The root bug allows anyone to log in or authenticate as a system administrator on systems running macOS High Sierra. In many circumstances, all they need to do is simply type in the username “root” and leave the password field blank, . The bug was so serious that it drew an uncharacteristically strong apology from Apple, which said its “customers deserve better.”
Read 1 remaining paragraphs | Comments
This tool runs automatically whenever users connect a FAT-formatted USB or SD storage device to their Mac. “The vulnerability allows arbitrary code to be executed with system-level privileges, which potentially lets a malicious device (such as the …
mac hacker – read more
If turned truly malicious, Wardle’s keychain exploit would likely be the second-stage of an attack, on top of an initial hack that would run rogue code on an Apple machine. He claimed it wasn’t hard to get malicious code running on a Mac today.
mac hacker – read more