“Someone at Apple seriously dropped the ball and put an unforgivable security flaw inside macOS High Sierra,” Jonny Evans writes for Computerworld.
“Complacency and incompetence are the biggest computer security threats, and Apple’s latest Mac security flaw seems to combine both of these,” Evans writes. “The flaw means anyone with physical access to your Mac can get inside the machine and tinker with it.”
Evans writes, “The problem (which first got disclosed here) was first revealed in a Tweet by Lemi Orhan Ergin.
Dear @AppleSupport, we noticed a *HUGE* security issue at MacOS High Sierra. Anyone can login as "root" with empty password after clicking on login button several times. Are you aware of it @Apple?
“This is a monumental error,” Evans writes. “It also seems completely avoidable – it’s not as if every hacker anywhere doesn’t use the word ‘root’ in an attempt to penetrate security. The only way Apple’s engineers might have improved on this (i.e. made it worse) is if they had used the password ‘123456.’ The existence of the problem is shameful. Why does it exist and who is responsible?”
Imagine a locked door, but if you just keep trying the handle, it says "oh well" and lets you in without a key. https://t.co/KBW4qntMdA
Read more, and how to fix this shameful security flaw, in the full article here.
MacDailyNews Take: Tim Cook’s Apple. That’s where the buck stops, right after it flits across Craig Federighi’s desk in this case, in a properly-run enterprise.
“Oh, but Apple’s basically printing money,” some cry! “Look at the share price; it’s near an all-time high!”
The quality has been slipping for years and the mistakes, bad designs, stupid decisions, product delays and worse have been piling up. Exactly, how do you so thoroughly fsck up your top-of-the-line Macintosh by “designing yourself into a thermal corner” while trying to prove that you can “still innovate, your ass” (and failing abysmally) and not be able to deliver a replacement for going on FOUR YEARS?! Even HP and/or Dell could do it in 4 weeks. ASUS could do it on 4 days. If anyone needs a stronger indication of the existence of a problem at Apple that stems from the very top, they’re batshit delusional.
So, when you produce a $300 coffee table book with 450 painstakingly shot photographs on “specially milled German paper with gilded matte silver edges, using eight color separations and low-ghost inks” and even trumpet that it “took more than eight years to create,” but you can’t make or even bother to update the Mac Pro for over four years… Hey, you deserve every single bit of criticism and then some, if not for your horribly misplaced priorities and blatantly obvious mismanagement, then for your abject tone-deafness alone.
In other words, doing your real job first grants you the ability to screw around on some vanity projects without criticism. — MacDailyNews, May 18, 2017
This lack of focus, lack of attention to detail, lack of striving for perfection will catch up to Apple eventually if it is not arrested and corrected in time.
So – sigh – we once again present to Apple CEO Tim Cook, where the buck supposedly stops, the Trophy for Misplaced Priorities: The Misplaced Priorities Trophy
Luckily for Tim Cook, Steve Jobs left him a perpetual profit machine that can absorb pretty much any lackadaisical fsckatude that can be thrown into the spokes. — MacDailyNews, November 17, 2017
You wouldn’t expect this from me, but stuff happens. They will fix it and get on with it.
Where I will be critical is with the aura that’s been projected forever by Apple and their user’s that OSX is infallible. We all know that there’s no such thing. Hopefully some humility will enter the picture now.
I don’t know any Mac users that think Macs are infallible (that’s all in your head), but we do know that Macs are better when it comes to the amount of work needed to secure your computer, and keep it running properly. There’s no argument on that, Macs have a lower total cost of ownership and Mac users are more productive. A big part of that is less fiddling with the machine and OS.
You are in the extreme minority of Mac users. The perception of less “viruses”, which to the common person means all malware has even been advertised.
Malware is less of a problem on the Mac. It exists but it’s not something Mac users need to fret about. I know lots of Windows users, and most of them have had some sort of issue with malware buggering up their machines. I don’t know any Mac users that have had a malware issue. That isn’t luck. Macs are more locked down, sandboxed, what have you. There are system level apps at work in OSX, I get warnings about installing apps or downloading files, and there’s some kind of built in anti-malware app as well, XProtect. It is also a numbers game, Windows is targeted much more than Mac.
I still think it’s mostly in your head, because you’re pissed at Apple about something or other, you’re projecting maybe? Malware is less of a problem on the Mac, that’s just the way it is. I got my parents an iMac, I wouldn’t ever buy them a Windows machine, that would be a nightmare, I don’t have the time to support it and keep it running and safe for them.
Malware is indeed less of a problem on the Mac. But I still think that an exposure like this ought to bring some humility. I have a huge aversion to BS, and in this case some humble pie is not wrong.
On the other hand, I do have several axes to grind, but I always try to respond with facts, and if you notice, I actually was supportive of Apple in my opening comment. Switching to Apple in 2008-2009 got me my “cynicism” stripes. I don’t like IT departments over my property that I don’t control. But I digress….
“Malware is indeed less of a problem on the Mac.” Yes, that’s what I said. You are imagining a lot of “the aura that’s been projected forever by Apple”. People aren’t stupid, they know Macs aren’t invulnerable, but they also know they don’t have to worry too much about malware on the Mac. You have to try to get malware on a Mac, there’s so many warning dialog boxes popping up and in many cases you would have to enter your admin password to install or run the malware. OSX generally works so smoothly that it is glaringly obvious when something out of the ordinary is happening. Makes it easier to catch malware before you accidentally install it thinking it’s an update for whatever.
See, you’re deflecting. Apple really screwed up on this one, and all I say is some humility from your ilk is called for. Don’t want to eat your humble pie, don’t. Doesn’t change the facts.
PS-Screw MS, but your terribly Windows ignorant. When did you last use it? Vista?
My wife uses it now, I have to help her with Windows 10, it’s a mess compared to OSX. I’m not deflecting, I’m just stating that malware is far less of a problem on OSX, and you already agreed to that, thanks.
Your assumption is that Apple hasn’t been humble about security. I would say they have been, they do a lot of work on security and they patch things pretty quick, and they introduced a lot of security measures over the last ten years. You think Apple needs to eat humble pie because you have some kind of problem with Apple. I don’t know any Mac users who think Apple is perfect. You’re just making another assumption, projecting your issues on others.
I have no problem saying Apple screwed the pooch on this one. Then they fixed it. Who is telling you Apple is perfect and never makes mistakes? I don’t know anyone who says that. That’s why I’m saying it’s mostly in your head.
Then you also know that for years now (Windows 8?) you need to answer a dialog to install software and that a fee AV and Firewall are included with Windows. Personally, I use Symantec.
I can’t go in circles with you. You already said “Malware is indeed less of a problem on the Mac.” That’s the end of it.
You said OSX does x,y,z which Windows does (and did) as well. What circles?
I didn’t say Macs do x, y, z. I said malware is much less of a problem on the Mac and you AGREED. You can’t seriously be using a single decade old ad to ‘prove’ Apple is saying Macs don’t get any viruses ever? Come on man, nobody believes that, people aren’t that stupid, they know it’s an ad. The takeaway from that ad is that malware is much less of a problem on Macs, and I’ll remind you that you AGREED that was true. As for your analysis article, the main point in it is “The main message throughout all of the commercials is that MAC is a better computer” and that is true, OSX is much easier to use, more worry free, more productive, Macs have a longer usable lifespan, lower TCO, etc.
You said…
“there’s so many warning dialog boxes popping up and in many cases you would have to enter your admin password to install or run the malware. ” Windows too.
“and there’s some kind of built in anti-malware app as well, XProtect.” Windows too, it’s called Windows Defender and Windows firewall.
Let’s not even debate the “runs more smoothly”, yes it does. It does less. Macs generally aren’t easily upgradable, Windows needs to support the universe of hardware. Apple has problems even with their limited subset.
Well duh, OSX and Windows do similar things. That was never the discussion. You said “Malware is indeed less of a problem on the Mac.” That was my point and you AGREED. Get over it. However, it is also true that Windows is far more clunky and awkward getting those similar things done. I know, I have to help my wife use Windows 10. Given a choice I would not use Windows, it is not a pleasant experience. It is a necessary experience in some cases, but none of that was central to our discussion. I said “Malware is less of a problem on the Mac.” and then you finally AGREED saying “Malware is indeed less of a problem on the Mac.” That’s the end of the discussion I’m afraid. You AGREED with my central argument. I win. Go home now.
I hate misleading pictures of the Mac Pro like that one… it’s absolutely NOT black. It’s just a silvery mirror finish, brushed aluminum not even tinted black.
Anyway, just enable the root user yourself, and set an actual password. Problem solved. Just make note that you should disable it either after the bug is fixed or before you sell it/give it away.
Uh, Kate? I have one. It’s not a silvery mirror mirror finish. . . and brushing such a mirror finish ruins the mirror. It’s anodized black.
But, you’re right about mitigating this problem. Just enable the Root user and add a complex password and then disable the root user. Problem solved. You don’t need to wait to disable the root user. Do it right away WITH the password selected. It remains.
I’ve seen them in the store, they’re not black unless you’re colorblind or in a pitch black room. They’re silver and reflective.!5&37 look like garbage. Put it next to a jet black iPhone 7 or a black stainless steel watch and you’ll see what I mean. They look like the trashy chrome you see on mororcycles, not as pictured in marketing images.
I don’t think its meant to be the actual Pro. That is MDN’s “Misplaced Priorities Trophy”, which I am guessing is meant to look like the Pro but as a trophy (all shiny but black since its an “anti-trophy”, or a “losers” trophy.)
Under Tim Cook Apple SW has become the land of eternal beta- way too much stuff is not ready to ship when released.
Speaking of the mythical Mac Pro trotted out earlier this year- you have not heard or seen a peep from Apple since. My guess is that was a PR stunt to shut up the online discontent with Apple. They hope the Fanbois enjoy their new overpriced iMac painted Black and called a Pro device.
Tim Cook, if a user cannot upgrade it, put standard memory, expansion cards, graphics cards and such, it is in no way a Pro device beyond the term applied for marketing.
It’s actually the agile development process. You release a minimum viable product, then iterate the heck out of it. There’s no complex electronic gizmo you buy today from anywhere that won’t be upgraded multiple times.
You are wrong – again. I did write a longer response but MDN has blocked me because I put them right on taking a day to get up to speed with this actual while there were too busy pretending to use Pixalmator Pro. So hard to circumvent MDSnooze blocking 😂😂😂😂😂😂😂😂😂
It is, Jared, but that’s no excuse for Apple. I’ve never bought anything but Apple since my first 1986 Mac Plus, but I’ve always, and still say, if I ever find anything I think is better, I’m gone. I’ve been very tolerant with much of Apple’s junk.
Apple is in disarray. Jobs would never have allowed this to happen. But that’s why Apple is producing mediocre products, following instead of leading and postponing product releases.
Oh yea, and Apple is now working on driver less cars.
Thanks MDN my confidence is restored even though it took you too long to put it on the site and comment.
I absolutely agree that all the attention to very detailed matters on the new spaceship clearly wasn’t applied to their products and thus was a highly misapplied effort.
I’m an Apple customer for 3 reasons only:
1) privacy
2) security
3) well designed products
My confidence in Apple has been eroding for years. There’s a laundry list of “wtf were they thinking” that I just cannot and won’t waste my time defending them against.
They’re just lucky the iOS/Mac ecosystem and integration is sufficiently good (for now) to keep myself and others from jumping to the alternatives, which are even worse. Unless they get their act together though, at some point it becomes impossible to justify the cost that Apple demands on things. Already there’s Apple die-hards discovering Alexa’s apparent superiority to Siri thanks to the low-cost Echo Dots and non-shipping Homepod.
“Thanks MDN my confidence is restored even though it took you too long to put it on the site and comment.”
Too long, indeed. I submitted it as soon as I heard it yesterday, which was just about an hour after it hit the interwebz. The solution is failry obvious to anyone here, so we just needed to be aware, not told how to fix it. And for those who couldn’t have determined the solution, our feedback would have quickly set them on the right path.
Well, that is the issue isn’t it? It is possible to have a normal user, or even an administrator without a password. You can even do it on a Windows PC. . . but on a Mac, Root should always require a password.
This issue can only come up if the Mac has multiple accounts enabled and is configured to ask on the lock screen which account to log into. It might be useful to have a guest or children’s account that has limited access to resources and no password. That is no worse security than having a password that is posted on the device with a sticky note. Similarly, a user who is confident that their device is physically secure may rely on having just the protection of an obscure user name without an additional password.
My guess is that this is a shortcut the High Sierra coders put in to expedite access to the root account during development and then forgot to remove. Stupid and inexcusable, but understandable. Illustrates why back doors are a terrible idea.
Shameful? There’s a major security issue at Microsoft nearly every day and everyone accepts. Shit happens sometimes. Get over it and appreciate the Apple products and eco system for what they are- the best in the world.
Most people do not leave their computer laying around for someone to try and login as root. yeah its a stupid flaw, but like anything Apple does, its always overblown, Windows is a security cesspool and it always gets a big ho-hum…
The very fact that someone seemingly literally tripped over the issue it seems after the OS has been out for months.. shows how obscure the issue is.. Apple will patch it shortly and its all done..
For every security issue, my first question is “do they need physical access to the computer”. If they do, then my concern drops immensely. (plus, I always enable root for “reasons” so this doesn’t affect me.)
This can actually affect users remotely according to the discussion about it (yesterday!!) when it was more timely reported by AppleInsider.com not sure if that is true and wouldn’t know how to do it, but I think that maybe you are, well you know….wrong again. Twat.
I think you are the one that is an even bigger Twat. With a capital T.
Fucking Trolls are everywhere. Pull your finger out your butt and get a real job, moron!
Not exactly true if you use a Mac in a work environment. I heard of workers at software companies sending embarrassing emails if they find co-workers have left their machine unlocked. With this exploit, it would be very easy to enable root access.
In that sense the root issue becomes very dangerous when the machine is in a work environment. Obviously users should always lock their machine when they go away (even for a few minutes like going to the bathroom). For a laptop that is easy since you just close the lid.
No, this is an issue in which when root is disabled this exploit makes it active.
The best solution is to enable root and create your own password, this prevents the exploit working.
Instructions are in the linked to article.
In many work environments, the IT guys use root access to control how ordinary users can use the machine. If they have done this to a particular Mac, root has a password and the exploit will fail.
This can only come up if the machine has multiple user accounts (so that the lock screen requires entering both an account name and password), one of those accounts is not already root, and an intruder tries to log in as root multiple times with a blank password.
Assuming that everybody installs the security update from this morning, it cannot come up at all.
What a gaping security flaw. How did no one at Apple realize that this flaw existed. No wonder I wait 6 months before upgrading. I can’t trust Apple to get it right the first time. This isn’t a mere inconvenience, it’s an insult.
The reason no one noticed is that only about 1 in 10,000 Mac users ever enable Root. . . and then they only do it once to turn it on and add a password. They add the password, not noticing that no password works just as well as a password does.
Nor do they attempt to put in the word “Root,” “ROOT,” or “root” into the user field for no particular reason at all and then click ENTER just to see what might happen. That is something only someone without a paying job, lots of time to kill, and nothing better to do, does. That person is sometimes is rewarded by finding such rare and obscure results.
Mac Daily News, let’s not romanticize the past. Under Steve Jobs there was the Cube. It was too expensive for most consumers, and didn’t have expansion pros needed.
Then there was .mac colloid services which was a nightmare.
Sure, Jobs make sure to fire and berate teams for their screwing up, it these things happened under Jobs.
No company is perfect because people are not perfect. The big question is, how does Apple respond when it screws up?
You don’t have to look far in the Tech field to see where lack of focus and complacency takes you down the road. The most worrying thing is that despite surely being aware of that very clear evidence they still keep tripping over the manholes. This is becoming like the shell game with Cook as the clueless punter.
A fingerprint scanner would be nice, but Apple bought AuthenTec, shut it down and broke compatibility for the iPhone- I still have my Eikon fingerprint scanners. Only the most expensive laptops support fingerprint ID.
Facial Recognition ( a la Windows Hello) is only available on iOS on the $1,000 + iPhone.
So, not only can we not get a real Mac Pro, any unattended and powered up Mac is a security risk.
We now have drone video of the new Apple Campus! What could be better for Apple owners than seeing this new, expensive edifice so near completion. Stop worrying about stupid things like Apple ignoring the Mac and security holes a truck can be driven through and just gaze upon this wonderful new structure.
FCOL people (and author) relax its software and bugs happen. Does this guy have a clue about writing and testing code?
It sounds to me like this would be hard to expose unless you’re standing at the computer? I don’t know more than what I read here so it sounds like you have to manually click a login button many times. Sounds like you have to be manually at the computer, not something that can be remotely hacked/cracked. Could be wrong, but sounds like they’re making a bigger deal of it than it is.
Wow. That would be an unforgivable error. Somebody’s head needs to roll.
You wouldn’t expect this from me, but stuff happens. They will fix it and get on with it.
Where I will be critical is with the aura that’s been projected forever by Apple and their user’s that OSX is infallible. We all know that there’s no such thing. Hopefully some humility will enter the picture now.
I don’t know any Mac users that think Macs are infallible (that’s all in your head), but we do know that Macs are better when it comes to the amount of work needed to secure your computer, and keep it running properly. There’s no argument on that, Macs have a lower total cost of ownership and Mac users are more productive. A big part of that is less fiddling with the machine and OS.
You are in the extreme minority of Mac users. The perception of less “viruses”, which to the common person means all malware has even been advertised.
Malware is less of a problem on the Mac. It exists but it’s not something Mac users need to fret about. I know lots of Windows users, and most of them have had some sort of issue with malware buggering up their machines. I don’t know any Mac users that have had a malware issue. That isn’t luck. Macs are more locked down, sandboxed, what have you. There are system level apps at work in OSX, I get warnings about installing apps or downloading files, and there’s some kind of built in anti-malware app as well, XProtect. It is also a numbers game, Windows is targeted much more than Mac.
I still think it’s mostly in your head, because you’re pissed at Apple about something or other, you’re projecting maybe? Malware is less of a problem on the Mac, that’s just the way it is. I got my parents an iMac, I wouldn’t ever buy them a Windows machine, that would be a nightmare, I don’t have the time to support it and keep it running and safe for them.
Malware is indeed less of a problem on the Mac. But I still think that an exposure like this ought to bring some humility. I have a huge aversion to BS, and in this case some humble pie is not wrong.
On the other hand, I do have several axes to grind, but I always try to respond with facts, and if you notice, I actually was supportive of Apple in my opening comment. Switching to Apple in 2008-2009 got me my “cynicism” stripes. I don’t like IT departments over my property that I don’t control. But I digress….
“Malware is indeed less of a problem on the Mac.” Yes, that’s what I said. You are imagining a lot of “the aura that’s been projected forever by Apple”. People aren’t stupid, they know Macs aren’t invulnerable, but they also know they don’t have to worry too much about malware on the Mac. You have to try to get malware on a Mac, there’s so many warning dialog boxes popping up and in many cases you would have to enter your admin password to install or run the malware. OSX generally works so smoothly that it is glaringly obvious when something out of the ordinary is happening. Makes it easier to catch malware before you accidentally install it thinking it’s an update for whatever.
See, you’re deflecting. Apple really screwed up on this one, and all I say is some humility from your ilk is called for. Don’t want to eat your humble pie, don’t. Doesn’t change the facts.
PS-Screw MS, but your terribly Windows ignorant. When did you last use it? Vista?
My wife uses it now, I have to help her with Windows 10, it’s a mess compared to OSX. I’m not deflecting, I’m just stating that malware is far less of a problem on OSX, and you already agreed to that, thanks.
Your assumption is that Apple hasn’t been humble about security. I would say they have been, they do a lot of work on security and they patch things pretty quick, and they introduced a lot of security measures over the last ten years. You think Apple needs to eat humble pie because you have some kind of problem with Apple. I don’t know any Mac users who think Apple is perfect. You’re just making another assumption, projecting your issues on others.
I have no problem saying Apple screwed the pooch on this one. Then they fixed it. Who is telling you Apple is perfect and never makes mistakes? I don’t know anyone who says that. That’s why I’m saying it’s mostly in your head.
Then you also know that for years now (Windows 8?) you need to answer a dialog to install software and that a fee AV and Firewall are included with Windows. Personally, I use Symantec.
I can’t go in circles with you. You already said “Malware is indeed less of a problem on the Mac.” That’s the end of it.
You said OSX does x,y,z which Windows does (and did) as well. What circles?
Then finally, regarding the “aura”
https://www.bing.com/videos/search?q=justin+long+get+a+mac+viruses&qpvt=justin+long+get+a+mac+viruses&view=detail&mid=D99FC6B06A413366A9E4D99FC6B06A413366A9E4&FORM=VRDGAR
Or this…
http://sites.psu.edu/aubreyleap/2014/07/23/get-a-mac-campaign-analysis/
I didn’t say Macs do x, y, z. I said malware is much less of a problem on the Mac and you AGREED. You can’t seriously be using a single decade old ad to ‘prove’ Apple is saying Macs don’t get any viruses ever? Come on man, nobody believes that, people aren’t that stupid, they know it’s an ad. The takeaway from that ad is that malware is much less of a problem on Macs, and I’ll remind you that you AGREED that was true. As for your analysis article, the main point in it is “The main message throughout all of the commercials is that MAC is a better computer” and that is true, OSX is much easier to use, more worry free, more productive, Macs have a longer usable lifespan, lower TCO, etc.
You said…
“there’s so many warning dialog boxes popping up and in many cases you would have to enter your admin password to install or run the malware. ” Windows too.
“and there’s some kind of built in anti-malware app as well, XProtect.” Windows too, it’s called Windows Defender and Windows firewall.
Let’s not even debate the “runs more smoothly”, yes it does. It does less. Macs generally aren’t easily upgradable, Windows needs to support the universe of hardware. Apple has problems even with their limited subset.
Well duh, OSX and Windows do similar things. That was never the discussion. You said “Malware is indeed less of a problem on the Mac.” That was my point and you AGREED. Get over it. However, it is also true that Windows is far more clunky and awkward getting those similar things done. I know, I have to help my wife use Windows 10. Given a choice I would not use Windows, it is not a pleasant experience. It is a necessary experience in some cases, but none of that was central to our discussion. I said “Malware is less of a problem on the Mac.” and then you finally AGREED saying “Malware is indeed less of a problem on the Mac.” That’s the end of the discussion I’m afraid. You AGREED with my central argument. I win. Go home now.
Thank you Justin Long.
What would we say if this were a Windows bug?
Perhaps you should consider shutting down MND, you’re turning into a cynical apple hater website, you can always switch to something else.
Wrong. We want to love Apple. Which is why we hate such sloppy failures.
I hate misleading pictures of the Mac Pro like that one… it’s absolutely NOT black. It’s just a silvery mirror finish, brushed aluminum not even tinted black.
Anyway, just enable the root user yourself, and set an actual password. Problem solved. Just make note that you should disable it either after the bug is fixed or before you sell it/give it away.
Uh, Kate? I have one. It’s not a silvery mirror mirror finish. . . and brushing such a mirror finish ruins the mirror. It’s anodized black.
But, you’re right about mitigating this problem. Just enable the Root user and add a complex password and then disable the root user. Problem solved. You don’t need to wait to disable the root user. Do it right away WITH the password selected. It remains.
I’ve seen them in the store, they’re not black unless you’re colorblind or in a pitch black room. They’re silver and reflective.!5&37 look like garbage. Put it next to a jet black iPhone 7 or a black stainless steel watch and you’ll see what I mean. They look like the trashy chrome you see on mororcycles, not as pictured in marketing images.
I don’t think its meant to be the actual Pro. That is MDN’s “Misplaced Priorities Trophy”, which I am guessing is meant to look like the Pro but as a trophy (all shiny but black since its an “anti-trophy”, or a “losers” trophy.)
Under Tim Cook Apple SW has become the land of eternal beta- way too much stuff is not ready to ship when released.
Speaking of the mythical Mac Pro trotted out earlier this year- you have not heard or seen a peep from Apple since. My guess is that was a PR stunt to shut up the online discontent with Apple. They hope the Fanbois enjoy their new overpriced iMac painted Black and called a Pro device.
Tim Cook, if a user cannot upgrade it, put standard memory, expansion cards, graphics cards and such, it is in no way a Pro device beyond the term applied for marketing.
It’s actually the agile development process. You release a minimum viable product, then iterate the heck out of it. There’s no complex electronic gizmo you buy today from anywhere that won’t be upgraded multiple times.
You are wrong – again. I did write a longer response but MDN has blocked me because I put them right on taking a day to get up to speed with this actual while there were too busy pretending to use Pixalmator Pro. So hard to circumvent MDSnooze blocking 😂😂😂😂😂😂😂😂😂
Tim may be a good CEO for Just in time inventory. But he lacks Steve Jobs passion for detail.
Still safer than any Windows PC 😄
It is, Jared, but that’s no excuse for Apple. I’ve never bought anything but Apple since my first 1986 Mac Plus, but I’ve always, and still say, if I ever find anything I think is better, I’m gone. I’ve been very tolerant with much of Apple’s junk.
Apple is in disarray. Jobs would never have allowed this to happen. But that’s why Apple is producing mediocre products, following instead of leading and postponing product releases.
Oh yea, and Apple is now working on driver less cars.
Thanks MDN my confidence is restored even though it took you too long to put it on the site and comment.
I absolutely agree that all the attention to very detailed matters on the new spaceship clearly wasn’t applied to their products and thus was a highly misapplied effort.
I’m an Apple customer for 3 reasons only:
1) privacy
2) security
3) well designed products
My confidence in Apple is starting to erode.
Reason 4) Ecosystem & Continuity
My confidence in Apple has been eroding for years. There’s a laundry list of “wtf were they thinking” that I just cannot and won’t waste my time defending them against.
They’re just lucky the iOS/Mac ecosystem and integration is sufficiently good (for now) to keep myself and others from jumping to the alternatives, which are even worse. Unless they get their act together though, at some point it becomes impossible to justify the cost that Apple demands on things. Already there’s Apple die-hards discovering Alexa’s apparent superiority to Siri thanks to the low-cost Echo Dots and non-shipping Homepod.
“Thanks MDN my confidence is restored even though it took you too long to put it on the site and comment.”
Too long, indeed. I submitted it as soon as I heard it yesterday, which was just about an hour after it hit the interwebz. The solution is failry obvious to anyone here, so we just needed to be aware, not told how to fix it. And for those who couldn’t have determined the solution, our feedback would have quickly set them on the right path.
“My confidence in Apple is starting to erode.”
Ditto. 🙁
Why is the OK button not disabled when no password text is entered?
Well, that is the issue isn’t it? It is possible to have a normal user, or even an administrator without a password. You can even do it on a Windows PC. . . but on a Mac, Root should always require a password.
In past versions of OS X, you could not use root unless you set the password.
This issue can only come up if the Mac has multiple accounts enabled and is configured to ask on the lock screen which account to log into. It might be useful to have a guest or children’s account that has limited access to resources and no password. That is no worse security than having a password that is posted on the device with a sticky note. Similarly, a user who is confident that their device is physically secure may rely on having just the protection of an obscure user name without an additional password.
My guess is that this is a shortcut the High Sierra coders put in to expedite access to the root account during development and then forgot to remove. Stupid and inexcusable, but understandable. Illustrates why back doors are a terrible idea.
Shameful? There’s a major security issue at Microsoft nearly every day and everyone accepts. Shit happens sometimes. Get over it and appreciate the Apple products and eco system for what they are- the best in the world.
Most people do not leave their computer laying around for someone to try and login as root. yeah its a stupid flaw, but like anything Apple does, its always overblown, Windows is a security cesspool and it always gets a big ho-hum…
The very fact that someone seemingly literally tripped over the issue it seems after the OS has been out for months.. shows how obscure the issue is.. Apple will patch it shortly and its all done..
For every security issue, my first question is “do they need physical access to the computer”. If they do, then my concern drops immensely. (plus, I always enable root for “reasons” so this doesn’t affect me.)
This can actually affect users remotely according to the discussion about it (yesterday!!) when it was more timely reported by AppleInsider.com not sure if that is true and wouldn’t know how to do it, but I think that maybe you are, well you know….wrong again. Twat.
I think you are the one that is an even bigger Twat. With a capital T.
Fucking Trolls are everywhere. Pull your finger out your butt and get a real job, moron!
You are wrong – again
Physical access is (was) not required to inflict this bug, but remote login would have needed to be set to ‘all users’, not just a few.
Not exactly true if you use a Mac in a work environment. I heard of workers at software companies sending embarrassing emails if they find co-workers have left their machine unlocked. With this exploit, it would be very easy to enable root access.
In that sense the root issue becomes very dangerous when the machine is in a work environment. Obviously users should always lock their machine when they go away (even for a few minutes like going to the bathroom). For a laptop that is easy since you just close the lid.
So if root is disabled, which it is by default, does that stop this issue?
No, this is an issue in which when root is disabled this exploit makes it active.
The best solution is to enable root and create your own password, this prevents the exploit working.
Instructions are in the linked to article.
In many work environments, the IT guys use root access to control how ordinary users can use the machine. If they have done this to a particular Mac, root has a password and the exploit will fail.
This can only come up if the machine has multiple user accounts (so that the lock screen requires entering both an account name and password), one of those accounts is not already root, and an intruder tries to log in as root multiple times with a blank password.
Assuming that everybody installs the security update from this morning, it cannot come up at all.
What a gaping security flaw. How did no one at Apple realize that this flaw existed. No wonder I wait 6 months before upgrading. I can’t trust Apple to get it right the first time. This isn’t a mere inconvenience, it’s an insult.
The reason no one noticed is that only about 1 in 10,000 Mac users ever enable Root. . . and then they only do it once to turn it on and add a password. They add the password, not noticing that no password works just as well as a password does.
Nor do they attempt to put in the word “Root,” “ROOT,” or “root” into the user field for no particular reason at all and then click ENTER just to see what might happen. That is something only someone without a paying job, lots of time to kill, and nothing better to do, does. That person is sometimes is rewarded by finding such rare and obscure results.
Mac Daily News, let’s not romanticize the past. Under Steve Jobs there was the Cube. It was too expensive for most consumers, and didn’t have expansion pros needed.
Then there was .mac colloid services which was a nightmare.
Sure, Jobs make sure to fire and berate teams for their screwing up, it these things happened under Jobs.
No company is perfect because people are not perfect. The big question is, how does Apple respond when it screws up?
You don’t have to look far in the Tech field to see where lack of focus and complacency takes you down the road. The most worrying thing is that despite surely being aware of that very clear evidence they still keep tripping over the manholes. This is becoming like the shell game with Cook as the clueless punter.
I’ve said before…2016 was the year for me that I saw Apple really starting to fall about with their quality.
The Mac lineup is pathetic. The iCloud service isn’t great at all compared to Dropbox or OneDrive.
The software quality is also really sloppy.
My pc buddy who doesn’t even like Mac even said Cook is running the company into the ground in terms of quality. I couldn’t even argue against him.
That made me upset that a pc guy was actually right.
Let’s just say Apple can put talking poop as a new feature and still sell iPhones.
Talking poop might be the Clippy of today. Tread carefully, Apple.
A fingerprint scanner would be nice, but Apple bought AuthenTec, shut it down and broke compatibility for the iPhone- I still have my Eikon fingerprint scanners. Only the most expensive laptops support fingerprint ID.
Facial Recognition ( a la Windows Hello) is only available on iOS on the $1,000 + iPhone.
So, not only can we not get a real Mac Pro, any unattended and powered up Mac is a security risk.
A security update was just issued to fix this issue.
MDN is completely missing the point.
We now have drone video of the new Apple Campus! What could be better for Apple owners than seeing this new, expensive edifice so near completion. Stop worrying about stupid things like Apple ignoring the Mac and security holes a truck can be driven through and just gaze upon this wonderful new structure.
High Sierra isn’t a “Snow Leopard” release, not at all.
FCOL people (and author) relax its software and bugs happen. Does this guy have a clue about writing and testing code?
It sounds to me like this would be hard to expose unless you’re standing at the computer? I don’t know more than what I read here so it sounds like you have to manually click a login button many times. Sounds like you have to be manually at the computer, not something that can be remotely hacked/cracked. Could be wrong, but sounds like they’re making a bigger deal of it than it is.