https://9to5mac.com/2017/11/28/how-to-set-root-password/
This is blowing up across the Interwebs. If you’re using OS X 10.13, make sure you set a root password on your device.
For bonus rage, check out the comments on the original tweet:
https://twitter.com/lemiorhan/status/935578694541770752
… with people blaming this guy for not following “proper disclosure channels” before tweeting about this.
A public tweet sure as hell isnt proper disclosure.
If he had followed proper disclosure channels, they would have sued him into silence and maybe sooner or later gotten around to a fix. (Probably later, tbh. And probably with a description that masks the nature of the issue, if the '06 wifi exploit was any indicator)
I would definitely prefer to not have been left in the dark about something as severe and easy to exploit as this. Disclosure be damned.
Ignoring the hyperbole about suing him (Apple routinely works with folks on security releases) one of the points of responsible security releases is to ensure that there is a fix in place before disclosure. As someone responsible for actual systems in the wild targeted by very many asshats I welcome responsible disclosure for not giving every script kiddie in the world an option to break things for lulz.
No hyperbole here. I knew the guy who developed the wifi exploit in '06. He gave them the code, they lied and said there was no exploit, threatened to sue him if he released too much info (spoken with the other side of their mouth), then released a fix that they insisted was not related, but in looking into his report found something different. (While buried in the patch notes, was a description of exactly the thing he found in the first place)
And of course, nothing at all has changed in the intervening 12 years.
Let’s just say I’m skeptical. The company I worked for 12 years ago is still doing all the shady things today that they were then.
I get it. Skepticism is healthy.
Here’s the page Apple uses to credit responsible disclosure in, for example, their web front ends;
Here’s Apple’s policy:
A lot of this infrastructure surrounding security didn’t exist (or didn’t exist at this level of robustness) in 2006. Thankfully, the combination of the world moving forward combined with many hundreds of millions of IOS devices out there has helped in that regard, IMHO.
Courtesy of Jedakiah on the Arstechnica discussion of the subject:
Unless this helpful and apparently heedless of the darker implications person was the only one to have stumbled across it; I suspect that the cat was not only out of the bag; but out of the bag and busy planting a keylogger and a lifelike replica cat in the bag for the next time someone checks on the cat/bag status some time ago.
Responsible disclosure is great for many things.
This on the other hand is such an unfathomably stupid bug Apple deserves some embarrassment over it.
Maybe you aren’t someone who has to deal with the consequences of these sorts of things?
Sure, I have on numerous occasions.
This isn’t an obscure elevation of privilege, weakness in cryptography, exposed secret, or remote code execution. This is a mind bogglingly stupid issue that’s user serviceable and it appears this was already known. I’m all for shining a brighter spotlight on this.
As someone who deals with problems related or otherwise, how difficult would a fix to something like this be? For a site like this or otherwise
Well, in this case the fix is fairly trivial (adding root passwords, though thankfully that’s part of good systems policy 101), but in the general sense of what would have to be done - if there were an external service affected by a “0-day” vulnerability like this, without a fix, you’d have to lock it down as best you could:
Of course, in the abstract most of that doesn’t mean much, and I can’t think of a remotely-exploitable issue that was so egregious you ever really got past step 2 above. Part of that, though, is because it’s been a long time since someone released information about a vulnerability like this into the wild that wasn’t done with responsible disclosure in mind in the first place. 
it’s not the login window. It’s what I’d call the “privilege escalation” dialog, but I’m not sure what Apple calls it.
Supposedly it works from the login window as well.
Thankfully it isn’t, which is part of why I’m not up in arms about how this was disclosed.
Not in my experience.
You know what would help drive the point home? Video.
Yeah, you’re right. It seems to be confined to that elevation dialog. (Still doesn’t discount the severity of the issue, though!)
aaaand fixed:
