Friday, 26 February, 2021


Another macOS password prompt can be bypassed with any password

Another macOS password prompt can be bypassed with any password Another macOS password prompt can be bypassed with any password
Kristine Garrett | 11 January, 2018, 11:06

In November a year ago, a serious "root" flaw was discovered in macOS High Sierra that allowed anyone to log into the admin account simply by using the username "root" with a blank password after repeatedly clicking on the login button multiple times. Just open up the App Store system preferences and if the little padlock icon is locked, click on it. macOS will then prompt you for a username and password.

You can enable or disable automatic downloads and installation of app and operating system updates using this preference pane.

I personally tested this bug in macOS 10.13.1 and it would not work.

Password bug in macOS 10.13 App Store.

While the discovery of the flaw may be alarming for some Mac users, the potential for it to be exploited in an attack is perhaps limited.

First, an attacker would need to have physical access to the device itself and either have the administrator's password (which would allow them to make changes to the system even if the login requirement worked properly) or gain access while an administrator is already logged in.

Numerous settings within the App Store System Preferences window are also protected behind your Apple ID password and can't be changed using this method, but a nefarious user with physical access to your Mac could toggle the options that fall under the automatic update section. But if someone already has access to your computer, they could disable automatic security updates and take advantage of vulnerabilities that are regularly patched.

Apple has reportedly fixed the new bug in the beta version of macOS 10.13.3, its upcoming High Sierra update expected to release to the general public sometime this month, according to MacRumors.

IBTimes UK has reached out to Apple for further comment.

Recommended

loading...
...

More home cookin Wolves dominate Thunder More home cookin Wolves dominate Thunder Andre Roberson has missed five games for Oklahoma City because of left patellar tendinitis and isn't expected back Wednesday. In his first season in Minnesota, Teague entered the night averaging 13.4 points and a team-high 7.3 assists per game.

Gillian Anderson confirms she's leaving 'The X-Files' Gillian Anderson confirms she's leaving 'The X-Files' Anderson also reiterated her belief that the X-Files revival was a one-and-done project and not something new in and of itself. But "I don't want to be tied down to doing one thing for months and months".

Google is being sued for allegedly discriminating against white men Google is being sued for allegedly discriminating against white men Google is now facing another lawsuit accusing the company of paying female employees less than their male counterparts. Former Google employee James Damore sues the company for discrimination against conservative white men.

Deadly E. Coli Outbreak Linked To Romaine Lettuce 'Appears To Be Over' Deadly E. Coli Outbreak Linked To Romaine Lettuce 'Appears To Be Over' There is a very different view at Consumers Union, which is the policy and mobilization division of Consumer Reports . Fewer than 20 Americans have officially been diagnosed with the same strain, and they are spread across 13 states.

Nick Saban not interested in Giants' job Nick Saban not interested in Giants' job The speculation from Arians was quickly shot down by multiple outlets and that Saban has "zero interest" in the Giants job. Cowherd then asked Arians what job Saban coveted and he answered with the Giants. "Because they're the New York Giants ".

Predators officially sign trio of defenders to new deals Predators officially sign trio of defenders to new deals Subban was called for interference on McDavid who was on a breakaway opportunity in the third period. He was inches offside, but offside nonetheless, and thus no goal.

YouTube 'Looking at Further Consequences' For Logan Paul YouTube 'Looking at Further Consequences' For Logan Paul One week after star Logan Paul posted a video from Japan's " suicide forest" and quickly deleted it, YouTube has spoken out. Earlier, Paul issued two apologies after his initial video, and said he was taking a break from his regular video uploads.

Toronto's Serge Ibaka suspended 1 game, to miss Thursday vs. Cavs Toronto's Serge Ibaka suspended 1 game, to miss Thursday vs. Cavs The Raptors come into the game as the NBA's third-highest-scoring team, averaging 111 points an outing. However, they are still 7-3 in their last 10. "They've got a lot of young guys who are playing well".

Mets bring back Jay Bruce | What it means Mets bring back Jay Bruce | What it means He also can give young first baseman Dominic Smith some more time to develop without the pressure of having to produce every day. Bruce joins Leonys Martin of the Tigers as the second free-agent outfielder to sign a major league contract this winter.

North Royalton man charged with spying on people via computer malware North Royalton man charged with spying on people via computer malware The FBI said that it had seized a laptop belonging to Durachinsky that included the client control software. Cronan of the US Department of Justice Criminal Division, First Assistant US Attorney David A.

Pa. opioid 'disaster emergency' plans to help Berks facility Pa. opioid 'disaster emergency' plans to help Berks facility James Connolly, emergency physician and chair of the Drug Diversion Task Force at Evangelical Community Hospital, Lewisburg. Governor Tom Wolf declaring a State of Emergency for the growing opioid epidemic spreading across the Commonwealth.

Suspended Louisville forward Bowen enrolls at SC Suspended Louisville forward Bowen enrolls at SC Bowen told Goodman that his goal remained to play college basketball. "There's no way I'm involved in it", Bowen said to Goodman. The FBI alleges that Brian Bowen Sr., Brian Bowen's father, accepted the money.

Missing boater's body found on Lake Okeechobee Missing boater's body found on Lake Okeechobee On Wednesday, Kayler's body was found in the vicinity of the Clewiston water tower on Lake Okeechobee, according to FWC. Numerous agencies including the Florida Fish and Wildlife Conservation Commission, the United States Coast Guard, St.

Prime Minister to interact with leading economists and Sectoral experts Prime Minister to interact with leading economists and Sectoral experts Kumar added that NITI Aayog will soon come out with a new way of monitoring employment, based on various high-frequency data. The meeting was attended by several Union Ministers, including Finance Minister Arun Jaitley.

Senators want 'massive' fines for data breaches at Equifax, other firms Senators want 'massive' fines for data breaches at Equifax, other firms Equifax declined to comment directly on the new legislation, redirecting FOX Business' request to a third party organization representing all three credit agencies.