macOS High Sierra Bug Lets Anyone Gain Root Access

 
Hi guys hope you are all keeping well, and if not I am yet again going to drain the brightness from your day. If you own a Mac computer and run the latest version of Apple's operating system, macOS High Sierra, then you need to be extra careful with your computer. Apparently anyone and I mean anyone from your two year old to your grandad can break into your mac device and become a superuser. Yes I said it, a superuser a god of elevated privileges a root to all evil, only the geeks in the room will get that one. So here's the thing Apple are calling this a bug when they should really just come out and say:

 "look guys we turned on root to do some shit, then we kinda forgot to turn it off, and, em, looks like that's the image we used to roll out 1,000s of machines on, our bad.....
PS the iPhone X is great you should go buy one it comes with enhanced features like stealing your key biometrics data for facial recognition so the CIA don't have to." - This may or may not have been a statement made by Apple T&C's apply.

Here's How to Login as Root User Without a Password

If you own a Mac and want to try this exploit, follow these steps from admin or guest account:

• Open System Preferences on the machine.
• Select Users & Groups.
• Click the lock icon to make changes.
• Enter "root" in the username field of a login window.
• Move the cursor into the Password field and hit enter button there few times, leaving it blank.

With that macOS High Sierra logs the unauthorized user in with root privileges, allowing the user to access your Mac as a "superuser" with permission to read and write to system files, including those in other macOS accounts as well.

This flaw can be exploited in several ways, depending on the setup of the targeted Mac. With full-disk encryption disabled, a rogue user can turn on a Mac that's entirely powered down and log in as root by doing the same trick.

At Mac's login screen, an untrusted user can also use the root trick to gain access to a Mac that has FileVault turned on to make unauthorized changes to the Mac System Preferences, like disabling FileVault.

All the untrusted user needs to do is click "Other" at the login screen, and then enter "root" again with no password. However, it is impossible to exploit this vulnerability when a Mac machine is turned on, and the screen is protected with a password.

I suppose there is no point in doing the scary dance without having a solution to hand and just as easy the potential to carry out this exploit the fix is similarly as simple to fix just follow the steps below.

Here's How to Temporarily Fix the macOS High Sierra Bug

To fix the vulnerability, you need to enable the root user with a password. Heres how to do that:

• Open System Preferences and Select Users & Groups
• Click on the lock icon and Enter your administrator name and password there
• Click on "Login Options" and select "Join" at the bottom of the screen
• Select "Open Directory Utility"
• Click on the lock icon to make changes and type your username and password there
• Click "Edit" at the top of the menu bar
• Select "Enable Root User" and set a password for the root user account

This password will prevent the account from being accessed with a blank password.

Just to be on the safer side, you can also disable Guest accounts on your Mac. for this, head on to System Preferences → Users & Groups, select Guest User after entering your admin password, and disable "Allow guests to log in to this computer."

Securing your browser and online accounts

   Browsers:

One of the things that people normally give very little thought to is what browsers they use to surf the internet. Personally the two browsers that I use with the most frequency are:

-Chrome and Firefox

And the search engine that most people use on both of these browsers would be google. By using these popular services however you may also be giving up more personal information than you might be comfortable with. It is a known fact that Google has been tracking your web activity and this explains a lot of the target based ads that tend to appear on websites that you may visit. If you like to get a breakdown of exactly how this can impact you I suggest you take a look at Don't Track Us. To defend against this change the search engine you use to DuckDuckGo. DuckDuckGo does not collect or share any of your personal information. There's no search history, profile or anything else stored, sold, or given to third parties. This means that I can now browse the web without been targeted by ad campaigns temping you to buy the latest new gadgets that you can’t afford. In addition to this if you would like even more web anonymity download and installed the onion browser from Tor.

As stated on the Tor website “Tor is free software and an open network that helps you defend against traffic analysis, a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security.” Tor is also very easy to install and can be downloaded from the Tor Project. Once you have the above done there are additional steps that you can take to secure things even more.

Configure your browser’s security and privacy settings

Review your browser’s privacy and security settings to make sure you’re comfortable with what’s checked or unchecked. Frequently, browser updates are released to plug recently discovered security holes. So it’s important to always keep any browsers you use updated. I spoke about the importance of patching your applications in an earlier post and this is no different.
Set up Google alerts for your browser to stay current on any emerging security issues.
Plug-ins and extensions are also an area you need to be really wary of make sure you know what the purpose of the plug-in or extension is and what permissions you are giving it.
The majority of plug-ins and extensions are safe, however, and some can help increase your browser’s security. Below are 3 free browser extensions for added security that you can install.

• HTTPS Everywhere. The Electronic Frontier Foundation and The Tor Project jointly developed this Firefox, Chrome, and Opera extension. HTTPS is a communications protocol for securing communications over a computer network, vs. the standard HTTP protocol, which is more widely used but less secure. HTTPS Everywhere encrypts communication with many major websites to help secure your browsing experience.

• Web of Trust (also known as WOT). This extension for Internet Explorer, Firefox, Chrome, Safari, and Opera helps you determine if a website is safe to surf. The extension displays traffic signal icons next to URLs and links. Green means the site is reliable; yellow indicates you should proceed with caution; red translates to “steer clear.” .

• LongURL.org. If you’re on Twitter or Facebook etc and you see a shortened link embedded in an interesting post, you might click it. Shortened links have been known to mask malicious links. If you’re unsure of a shortened link, copy and paste it into the search box at LongURL.org. You’ll see where the link would take you, without having to actually click through to the site.

Online Accounts:

I believe that this is an area of exposure that you actually have the least control over as you are trusting a third party with my login credentials and personal information. With this trust you can only hope that they are properly securing your data. One area you do have control over however is how secure you make your login to these sites. In the past few years the main social media, email and service providers have offered two phase authentication or two step verification to help users protect their login details. I have  covered how to set this up on the following accounts.

-Twitter

-Gmail

-iTunes

It is straight forward to do this and I will start with Twitter. Once you log into your twitter account navigate to your profile picture at the top right of the page and click here. Now select settings once in the settings menu select security and privacy in here you can turn on log on verification. Once this is turned on you need to select a trusted device and every time you log onto twitter from now on you will need both your password and a unique code that will be sent to your chosen device.

To set this up on your gmail account which will secure all of your gmail accounts using this login i.e google drive, google plus etc. You need to log in and click the little nut type figure at the top right of your screen from the drop down menu select settings. From here select accounts and import and then select other google account settings. From here click on sign-in and security and follow the steps. At the end of the process google will show you a screen ticking off all of the area that are now protected.

To set up your iTunes account you need to go to https://appleid.apple.com and log in. Once logged in navigate to password and security in here you can set up two step verification. iTunes makes you wait three days after requesting to set this up just in case you are not who you say you are. I actually think that the three day waiting period is a good idea as you will get an email to say that two step verification was requested and this will give anyone who didn’t try and set this up time to protect themselves. Facebook also has this feature and I would recommend setting it up if you have a facebook account.