A massive bug with MacOS High Sierra was uncovered on Nov 28 which allows anyone can login local admin account with an empty password.
This bug allows anyone to login to the local admin account with the username “root” and no password needed. The security hole came into light after Turkish software developer Lemi Orhan mentioned it on twitter.
You can access it via System Preferences>Users & Groups>Click the lock to make changes. Then use “root” with no password. And try it for several times. The result is unbelievable!
They have notified the bug to Apple on Nov 23, and they also found the bug was already reported in developer forums and even in Apple Developer Forum.
Also Read Imgur Data Breach Exposed 1.7 Million Users Emails and Passwords by Hackers
Yesterday Apple released a security update which fixes the vulnerability of macOS High Sierra 10.13 and macOS High Sierra 10.13.1.
Apple issued the following statement
“Security is a top priority for every Apple product, and regrettably we stumbled with this release of macOS.
When our security engineers became aware of the issue Tuesday afternoon, we immediately began working on an update that closes the security hole. This morning, as of 8:00 a.m., the update is available for download, and starting later today it will be automatically installed on all systems running the latest version (10.13.1) of macOS High Sierra.
We greatly regret this error and we apologize to all Mac users, both for releasing with this vulnerability and for the concern it has caused. Our customers deserve better. We are auditing our development processes to help prevent this from happening again.”
CVE-2017-13872 assigned to this vulnerability, Apple strongly recommends confirming the Security Update.
In Terminal app type what /usr/libexec/opendirectoryd and if installed successfully you can see following project version numbers.
opendirectoryd-483.1.5 on macOS High Sierra 10.13
opendirectoryd-483.20.7 on macOS High Sierra 10.13.1
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…