developer Lemi Ergin<\/a>, lets anyone log into an admin account using the username “root” with no password. This works when attempting to access an administrator’s account on an unlocked Mac, and it also provides access at the login screen of a locked Mac.<\/p><\/blockquote>\nWe verified that on macOS High Sierra 10.13.1, “root” user is enabled by default with blank password. For comparison, OS X El Capitan has “root” user disabled by default.<\/p>\n
UPDATE:
\nWe verified that previous versions of macOS\/OS X\/Mac OS X have “root” user disabled by default.<\/p>\n
This is similar to the enabled-by-default-with-blank-password “administrator” accounts in Windows XP.<\/p>\n
By having “root” user disabled by default, potentially a remote attacker can compromise Macs running macOS High Sierra.<\/p>\n
Having said all that, anyone with physical access and the right knowledge can reset local user password.<\/p>\n","protected":false},"excerpt":{"rendered":"
As reported by\u00a0Juli Clover for MacRumors and numerous other sites: The bug, discovered by developer Lemi Ergin, lets anyone log into an admin account using the username “root” with no password. This works when attempting to access an administrator’s account on an unlocked Mac, and it also provides access at the login screen of a … <\/p>\n
Continue reading “Root Access Vulnerability in macOS High Sierra”<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[4],"tags":[381,3436,3397,3448,2648,936],"class_list":["post-16673","post","type-post","status-publish","format-standard","hentry","category-news","tag-apple","tag-high-sierra","tag-macos","tag-root","tag-security","tag-tech"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pcNtU-4kV","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/posts\/16673","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/comments?post=16673"}],"version-history":[{"count":3,"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/posts\/16673\/revisions"}],"predecessor-version":[{"id":16679,"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/posts\/16673\/revisions\/16679"}],"wp:attachment":[{"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/media?parent=16673"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/categories?post=16673"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/tags?post=16673"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"http:\/\/37prime.com\/news\/wp-content\/uploads\/2017\/11\/macOS-Change-root-Password-1.png\")
<\/p>\n