News for hackers. Stuff that matters.

A comment on Why doesn’t Apple make its devices as carefully as it’s making Apple Park?. Parent comment

Re:Why doesn’t Apple make its devices as carefully as it’s m... by SyneRyder on Tuesday December 12, 2017 @12:45AM (#15903256)
It wasn't limited to local access. This tweet should have got much more coverage at the time (note that ARD is Apple Remote Desktop):

https://twitter.com/unsynchronized/status/935656609140711426

"macos 10.13 bug isn't limited to root in all circumstances; via ARD, you can log in as any existing user (e.g. _applepay) and share the screen of the logged-in user. also _uucp is allowed to log in"

[ Parent | on HN ]
Re:Why doesn’t Apple make its devices as carefully as it’s m... by kemayo on Tuesday December 12, 2017 @01:05AM (#15903329)
It was limited to local access for people using the default settings, though, since ARD is something you have to explicitly enable in the system preference.

Not that this isn't a bad thing, but it's vastly better than a remote execution exploit which is default-enabled.

[ Parent | on HN ]