High Sierra root without a password

[cyrano]

It's all over the Mac fora by now. Remote exploitability confirmed. Short:

https://derflounder.wordpress.com/20...s-high-sierra/

In other words, if you're running High Sierra, set a password for you root account.

links:

https://www.macobserver.com/tips/qui...erability-fix/

https://www.theregister.co.uk/2017/1...s_high_sierra/

https://www.macrumors.com/2017/11/28...-admin-access/

http://appleinsider.com/articles/17/...w-instructions

https://techcrunch.com/2017/11/28/as...ierra-machine/

[jerome_oneil]

Wow. That's not even a small thing. I'd imagine every Apple Store display with High Sierra is being guarded by one of them Geniuses right now.

[cyrano]

The patch is out.

https://support.apple.com/en-us/HT208315

The Twitter message was just the first person to "see" the true possibilities. The bug had been on Apple's fora for months, as a solution to a very specific problem. That poster didn't even see the possibilities.

A bug report had been filled about two weeks ago. I guess there's some backlog in reading these...

Another serious local problem is that any logged on user can kill everything via the Terminal. Apple doesn't see that as a bug, letalone a security problem. It's a feature!