Surprise, surprise! Security by obscurity fails Apple's MacOS

High Sierra Root Access

Discovered by software engineer Lemi Orhan Ergin, the bug allows anyone who has access to your computer to gain full, administrative access in just seconds.

The level of unbridled access this security hole permits - and it abruptly being made public - will nearly certainly prompt Apple to move fast in releasing an update for its Mac operating system. BGR staff tested the bug on several devices running the most recent version of MacOS High Sierra, and were able to log in as the root user easily, with access to all other user accounts.

All you need to do to login is go to the login screen, type "root", leave the password box blank, and try to login. That said, this isn't good for macOS users and it looks bad for Apple. The bug gives anyone unauthorized administration access to a Mac using a very simple trick: logging in as root.

CNET independently confirmed this security flaw exists and reached out to Apple about the issue. The Apple Support Twitter account acknowledged Ergin's tweet highlighting the issue but did not provide any additional comment. Apple is generally good about patching issues like this quickly but for now, machines will remain vulnerable until they can push any updates.


To do so, open the System Preferences and click on the "Users & Groups" option. When the next menu appears, click the lock in the lower left to make changes.

Enter "root" again with no password.

Note that disabling the root user does not fix this, as you'll still be able to bypass it.

Related News:

  • Black Friday shoppers resort to punches at mall in Alabama

    Black Friday shoppers resort to punches at mall in Alabama

    The first incident they responded to was a report of shots fired in the Macy's parking lot around 10 p.m. Police said the fight was of a personal nature, and not over sales.
    Tencent to Release Localized, Altered Version in China

    Tencent to Release Localized, Altered Version in China

    China right now accounts for about 40-percent of the game's player base, the outlet points out, citing metrics from SteamSpy. In terms of the partnership on PUBG Corporation's side, it couldn't have found a better partner to work with in China.
    Uber paid off hackers in attempt to hide  theft

    Uber paid off hackers in attempt to hide theft

    Britain's data protection authority said it would work with agencies in the United Kingdom and overseas to investigate the matter. Law firm Keller Rohrback put out word on Wednesday that it is looking into the potential for a class action suit against Uber .
  • Incident at London's Oxford Circus station over: United Kingdom  police

    Incident at London's Oxford Circus station over: United Kingdom police

    British Transport Police tweeted just after 4:40 p.m. that officers were are on the scene. Shortly afterwards the Metropolitan Police also took similar calls.
    Suspect in NY terror attack indicted on murder, terrorism charges

    Suspect in NY terror attack indicted on murder, terrorism charges

    Saipov came to the USA legally in 2010 from Uzbekistan, where officials say he had no history of trouble with the law. Saipov allegedly admitted to planning an attack about a year ago and made a decision to use the truck two months ago.
    Apple's HomePod delay is the right decision

    Apple's HomePod delay is the right decision

    Apple's offering promises higher-end sound than the Google Home and Amazon Echo produces, albeit at a much larger $349 price tag. A prototype Apple HomePod is seen during the annual Apple Worldwide Developer Conference (WWDC) in San Jose, California, U.S.
  • You are what you drink

    You are what you drink

    If a glass of wine puts you to sleep, but harder drinks out with friends pump you up, you're not alone. It is worth also bearing in mind that there are compounds apart from alcohol in different drinks.
    Shootout between cops and criminals near Delhi's Dwarka Mor Metro Station

    Shootout between cops and criminals near Delhi's Dwarka Mor Metro Station

    The exchange of fire took place inside a house in which six suspected members of a gang active in Punjab had been hiding for a month.
    Rafale deal: Nirmala Sitharaman slams Congress, calls allegations 'shameful'

    Rafale deal: Nirmala Sitharaman slams Congress, calls allegations 'shameful'

    Sitharaman's statement came a day after Air Chief Marshal BS Dhanoa rebutted the Congress accusations on Rafael. The Congress has accused the NDA government of changing the "entire deal" to benefit a businessman.
  • Army called in to control situation in Islamabad

    Army called in to control situation in Islamabad

    So far one police official was martyred in I-8 Sector during the clashes while almost 200 persons of both sides had been injured. The lawmaker from NA-133 (Sheikhupura) was in the Batti Chowk area to negotiate with the protesters, Express News reported.
    Arab League leaders slam Iran amid regional tensions

    Arab League leaders slam Iran amid regional tensions

    Saad Hariri will head to Egypt on Tuesday after the Arab League accused Iran of "aggression" against Arab states. On Saturday, Mr Hariri was in Paris, where he met French president Emmanuel Macron.
    Yemen is suffering over failure to open ports, airports

    Yemen is suffering over failure to open ports, airports

    Saudi Arabia announced it shut down all ports after a Houthi ballistic missile attack near Riyadh's worldwide airport. A malnourished Yemeni child receives treatment at a hospital in the port city of Hodeida on November 05, 2017.


Most liked

Microsoft Office is now available for all Chromebooks
We checked every Chrome OS device we have and can confirm they all show every Office app in the Play Store ready for download. Chrome Unboxed reports that the apps are now available in Samsung's Chromebook Pro , Acer's Chromebook 15 and Acer's C771.

Amazon launches web-based tool for developing VR and AR experiences
Supported devices include Google's Daydream, HTC Vive, Facebook's Oculus Rift, and iOS mobile devices. The Amazon Sumerian also assists with mapping services from Mapbox.

Naya Rivera Hit Husband Ryan Dorsey in the Head, Police Say
She asked for primary custody of their son, but they reconciled not long after and Naya withdrew her request for sole custody. The statement says Dorsey had minor injuries and showed deputies a video that supported his account of the incident.

Mount Agung eruption: Indonesia issues highest aviation warning
But Bali's main Ngurah Rai airport remained open yesterday, although flights were affected. "The airport still operates normally". Government officials are insistent that the island remains safe for now outside of the area immediately surrounding Mount Agung.

Amazon CEO Jeff Bezos Now Worth $100 Billion
The Microsoft founder is now worth a mere $89 billion, according to Forbes and Bloomberg . Were he more selfish, Bloomberg estimates Gates could now be worth $150 billion.

Google Pixel smartphones gets smart battery features
Having the best phone in the world, which we might do with Pixel handsets, means nought if you're caught out with a flat battery. The Google Pixel smartphones have received positive reviews in many aspects but there is one major problem that many users face.

World Leaders Condemn Egypt Mosque Attacks, Calls For Collective Action Against Terrorism
President Donald Trump , in a post on Twitter on Friday, called the assault a "horrible and cowardly terrorist attack". Egypt has launched a prolonged anti-terror crackdown few years ago, trying to unroot extremists based in North Sinai.

European researchers claim to have identified North Korea's list of targets
North Korea joins Iran, Sudan, and Syria - the only countries designated by the U.S.as state sponsors of terrorism. The U.S. has maintained North Korea must cease its program before negotiations can begin.

Oppn ups pressure over winter session delay
While the Constitution does not specify as to how many times Parliament must meet in a year, the gap between two sessions can not be longer than six months.

Harrison Ford helps out driver who veered off California highway
As TMZ report, Ford was driving behind the woman, when she sped off an embankment. This is not the first time that Ford has lent a helping hand to others.

Gerry Adams to announce retirement as Sinn Féin president today
Adams, who has led Northern Ireland's second biggest political party for more than 30 years, has often been a controversial figure.

5 terrorists killed in encounter with security forces in J&K's Bandipora
Three militants were gunned down in Pulwama in an encounter in which an Army jawan was also killed on November 6. DGP, J&K, Shesh Paul Vaid said, "LeT commanders Zargam and Mehmood also eliminated in the operation".

Actor David Cassidy in critical condition due to organ failure
Cassidy has had numerous personal problems in the decades following his debut, ranging from substance abuse to bankruptcy. The 67-year-old David Cassidy has been stricken with dementia.

Katy Perry 'rejected for Chinese visa' ahead of Victoria's Secret show
Question. why the HELL did Victoria's Secret execs pick China to host their internationally-famous fashion show? A source told Page Six that she applied for a Visa to enter to country, but it was denied by Chinese officials.

2.6 million Floridians to travel during Thanksgiving holiday, AAA says
Air fares are at their lowest levels in five years for a round-trip flight for the top 40 domestic routes, AAA said. This coming Thanksgiving is expected to be another record breaker when it comes to travel.