News for hackers. Stuff that matters.

A comment on macOS High Sierra: Anyone can login as “root” with empty password. Parent comment

Re:macOS High Sierra: Anyone can login as “root” with empty ... by valine on Tuesday November 28, 2017 @04:04PM (#15801605)
It works remotely if remote login is enable.

edit: Screen sharing is is vulnerable not ssh. Either way its bad.

[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by djrogers on Tuesday November 28, 2017 @04:27PM (#15801927)
No it does not. I tested this rather carefully, and both ssh and screen sharing do not allow the user root with no password.
[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by ehntoo on Tuesday November 28, 2017 @04:59PM (#15802246)
I have not been able to trigger this with ssh, but certainly have been able to with Screen Sharing, even after explicitly re-disabling the root account.
[ Parent | on HN ]