News for hackers. Stuff that matters.

A comment on macOS High Sierra: Anyone can login as “root” with empty password. Parent comment

Re:macOS High Sierra: Anyone can login as “root” with empty ... by mhandley on Wednesday November 29, 2017 @05:00AM (#15805760)
One of my Macs is showing a root password change date of Nov 10th 2017. I can't explain that, so I'm reinstalling now. It did have sshd enabled and remotely accessible, though I thought root login was prohibited.

If I understood correctly, this particular bug was only exploitable from the GUI and this machine hasn't been away from home, so it's likely this isn't related, but posting here, in case it's part of a bigger picture.

[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by marcelfahle on Wednesday November 29, 2017 @05:29AM (#15805877)
OK, I guess when doing OP's root trick, the root user gets activated/created, and that's that's when the PW gets set to empty. I guess that's where my passwordLastSetTime comes from.
[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by haZard_OS on Thursday November 30, 2017 @09:59AM (#15816180)
This works remotely as well (although not through SSH, obviously).
[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by danielrangel on Wednesday November 29, 2017 @04:11PM (#15810896)
possibly the same timestamp here: 1510300538.767916 'Fri, 10 Nov 2017 04:55:38'
[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by gurkendoktor on Thursday November 30, 2017 @04:47AM (#15814594)
Oh wow. Is there any other explanation for this other than this having been exploited in the wild for almost three weeks? Or maybe someone just tried to log in over SSH to exploit some other weakness (something like predictable SSH passwords on jailbroken iOS devices), and happened to create the root user on your machine?

Did you also have sshd running, and do you know what kind of network you were using at the time?

[ Parent | on HN ]
Re:macOS High Sierra: Anyone can login as “root” with empty ... by marcelfahle on Wednesday November 29, 2017 @05:24AM (#15805860)
My root pw passwordLastSetTime says this morning.. the fuck??
[ Parent | on HN ]