Apple rushes to fix major password bug | 2017-11-29 |

Apple rushes to fix major password bug

Sun Online Desk     29th November, 2017 09:23:01 printer

Apple rushes to fix major password bug

Apple has said it is working to fix a serious bug within its Mac operating system.


The flaw in MacOS High Sierra - the most recent version - makes it possible to gain entry to the machine without a password, and also have access to powerful administrator rights.


The bug was discovered by Turkish developer Lemi Ergin.


He found that by entering the username "root", leaving the password field blank, and hitting "enter" a few times, he would be granted unrestricted access to the target machine.


Mr Ergin faced criticism for apparently not following responsible disclosure guidelines typically observed by security professionals.


Those with root access can do more than a normal user, such as read and write the files of other accounts on the same machine. A superuser could also delete crucial system files, rendering the computer useless - or install malware that typical security software would find hard to detect.


Thankfully, the bug cannot be exploited remotely, meaning an attacker would have to have physical access to a computer. That said, someone who gained remote access through other means would be able to use the flaw to control the machine it had access to.


The timing of the disclosure presents a major issue to Apple as it now must hurriedly put in place a fix before the vulnerability can be exploited by criminals.


"To enable the Root User and set a password, please follow the instructions here:


"If a Root User is already enabled, to ensure a blank password is not set, please follow the instructions from the ‘Change the root password’ section.”


Fuller instructions on how to set the root password were written up by MacRumors.


For those not confident enough to change system settings like this, security experts advise simply - don't let your Mac out of your sight, and be sure to apply the system update when prompted.


Source: BBC