Attn Mac High Sierra (OS X 10.13) users: major vulnerability exposed today -- protect yourself by setting a root password

I can’t imagine this would have been fixed with such expediency had “proper channels” been used, either.

Hopefully Apple learned from this as this was a pretty shocking lapse in QA.

While likely so, it also would have very likely been less widely known, as well. I’d hate to be in IT running a school mac program right about now.

3 Likes

Depending on the school’s setup, it might not be too bad. High Sierra came out in October, so it’s unlikely that the schools have rolled it out yet… they usually wait until the holidays to do a major system upgrade like that, and that’s without even considering that Adobe did not play with APFS at all when High Sierra was first released.

Further, IME, students don’t permanently store stuff on the local system drive, or at least have portable homes, so you could update your master image and image everything out, one lab at a time and be clear in a day (OK, a night). Your lab may vary, though.

1 Like

Looks like it was exploitable from the login screen, too.

(With video)

Wired made a good point - this wasn’t an instance of hacking or an exploit. It was literally Apple just letting you in after you knocked on the door.

Here’s a great root cause analysis of the bug:

1 Like

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.