Dear @AppleSupport, we noticed a *HUGE* security issue at MacOS High Sierra. Anyone can login as "root" with empty password after clicking on login button several times. Are you aware of it @Apple?
Show this thread
-
This does not require local access. It's exploitable remotely if "Screen Sharing" is enabled. Other sharing services may also be affected (authentication bypass).
By that do you mean the authentication bypass on the *initial* connection to the screen or just escalation once already connected?
-
-
For Screen Sharing it's both: You can auth as root in the initial request, which gets you to the regular login screen (also affected by the bug, so you can log into a desktop session as root)
-
for other services, I haven't tested it but I assume you could auth as root to e.g. AFP/Samba shares, bypassing normal user permissions checks.
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.