Update Immediately to Block the Root Vulnerability Bug

Lemi Orhan Ergin on Twitter:

We've reached out to Apple and will update this post when we hear back.

Yesterday we wrote about a publicly-disclosed problem in Apple's macOS 10.13, better known as High Sierra. You'll need to enter in your administrator name and password again, then open the menu bar in Directory Utility and click on "Edit" then 'Change Root Password...' You can find instructions on how to do so below. If, for some odd reason, you can't update your Mac immediately, you can apply a temporary Band-Aid by enabling a root user on your Mac. The bug reportedly is not in any other MacOS. Every baby or child then use that gap. It can also be exploited at the login screen of a locked Mac (even after a reboot), providing the flaw has been used before.

Security experts warned that the security hole was both embarrassing for the company and risky, allowing anyone with physical access - and in some instances remote access - to a Mac computer to gain full access to user data.

The glitch is said to also create a "root" account, in turn opening up all kinds of security risks for your computer to be targeted by unsavoury types.

Everyone running macOS 10.13.1 High Sierra should install this security update via Software Update immediately.


In October a flaw was discovered that could have allowed anyone to gain access to encrypted hard disk volumes. Ensuring that unauthorized users can't act as the root user in a Unix system is basic security, because anyone who can become root can do anything they want.

Turkish developer Lemi Orhan Ergan outed the flaw on Twitter on Tuesday (below) but has since received criticism for the "irresponsible" way in which he did so.

After installing the update, a Mac we tested that had previously vulnerable to the bug was no longer affected. When that happens, "Make sure to update your Macs and MacBooks at your earliest opportunity after it is released", he added.

Ironically, the support forum thread, a community discussion that seems to have gone unnoticed by Apple itself, was about losing administrator access after updating to High Sierra - and this very bug was presented as a handy hack to restore things to normal.

Related:

  • Tiger Woods on comeback trail

    Tiger Woods on comeback trail

    Tiger Woods spoke at a press conference Tuesday ahead of his comeback at this week's Hero World Championship starting on Thursday. The difference this time, Woods said, is that he doesn't feel pain, and he thinks now he can take on any shot.
    Leicester City 2-1 Tottenham Hotspur

    Leicester City 2-1 Tottenham Hotspur

    With a four game spell coming up where they play none of the top six, there's a good chance that Puel's quiet start could suddenly become very noisy.
    Prince Harry's Friends Couldn't Stop Talking About Meghan Markle Engagement Announcement

    Prince Harry's Friends Couldn't Stop Talking About Meghan Markle Engagement Announcement

    The home has been owned by the royal family since 1689, when King William III and Queen Mary II purchased it for £20,000. Personally, I love a great love story", she continued, referencing their choice to keep private.
  • Stokes 'not Australia-bound' after picture suggests Ashes call

    Stokes 'not Australia-bound' after picture suggests Ashes call

    There was widespread speculation on social media that he was heading to Australia after being pictured at the airport on Monday. Ben Stokes is not on his way to join England's Ashes squad in Australia , Press Association Sport understands.
    WashPost: CNN Set Itself Up for Trump's Weekend Attack

    WashPost: CNN Set Itself Up for Trump's Weekend Attack

    Left out of his challenge: Fox News, the network most likely to have favorable news coverage of his administration. Some see the move as an effort to hand the network over to a conservative buyer, like Rupert Murdoch.
    Time Magazine to be sold in for $2.8 million

    Time Magazine to be sold in for $2.8 million

    Koch Equity Development, the brothers' investment firm, is putting up $650 million to receive preferred equity in the deal. The deal is valued at $1.84 billion based on the offering price and number of shares of Time outstanding on September 30.
  • WaPo Reveals a Political Activist Faked a Roy Moore Story

    WaPo Reveals a Political Activist Faked a Roy Moore Story

    The intent by Project Veritas clearly was to publicize the conversation if we fell for the trap, ' Baron continued. The Post editors said they found "inconsistencies" with the woman's story on the internet.
    Judge Grants Waymo's Request To Postpone Trade Secret Trial Against Uber

    Judge Grants Waymo's Request To Postpone Trade Secret Trial Against Uber

    Jacobs was part of the "Strategic Services Group" at Uber, although Bloomberg says the team has now been renamed. Waymo filed suit in February alleging that the ride-hailing company stole crucial self-driving trade secrets.
    Background Checks For Black Friday Gun Purchases Reached All Time High

    Background Checks For Black Friday Gun Purchases Reached All Time High

    The previous record of 185,000 background checks on Black Friday 2016 narrowly beat the record set on Black Friday 2015. Gun checks, required for purchases at federally licensed firearm dealers, are not a measure of actual gun sales.
  • Gunman holds up Las Vegas casino

    Gunman holds up Las Vegas casino

    MGM Resorts International, which owns the Bellagio, issued a statement saying they are working with the police. The employees complied with the suspect's demands and handed him an undetermined amount of money.
    Start Pumping Your Fist: Jersey Shore Is Coming Back

    Start Pumping Your Fist: Jersey Shore Is Coming Back

    Also, Ronnie Ortiz-Magro, Nicole "Snooki" Polizzi , and Mike "The Situation" Sorrentino will be seen. The announcement was made during the premiere of Floribama Shore on Monday, November 27.
    BMW's all-new i8 Roadster makes LA debut

    BMW's all-new i8 Roadster makes LA debut

    The long-awaited i8 Roadster will go on sale alongside an updated version of the two-plus-two i8 coupe early next year. Its cell capacity has risen from a previous 20 Ah to 34 Ah, with energy capacity increasing from 7.1 kWh to 11.6 kWh.

Comments

Latest news

Uber Admits 2.7m UK Users Had Data Stolen In Hack
Uber spokeswoman Molly Spaeth said in an email the company is "committed to changing the way we do business". Ferguson says that Uber did not notify his office until this month, more than a year after the breach.

We're razing our Redmond campus to build a mini city
A two-acre open air plaza will house running and walking trails, soccer and cricket fields, and retail space. Microsoft says the new campus will be "built for pedestrians and bikes" with auto parking moved underground.

49ers announce Jimmy Garoppolo will start Sunday vs. Bears
The team announced on Tuesday that Garoppolo will be the 49ers starting quarterback against the Chicago Bears in Week 13. Beathard, who was making his fifth start after displacing veteran Brian Hoyer for the top job Week 6 in Washington.

PM Modi to inaugurate GES 2017, Ivanka Trump will speak
Even more promising, minority women have started almost 8 in 10 new women-owned businesses. The former entrepreneur said when women work, it creates a unique multiplier effect.

Melania Trump unveils White House Christmas decorations to mixed reviews
A mistletoe hangs over the doorway going from the Green Room into the Blue Room at the White House . The White House gingerbread house this year is a mini replica of the actual building.

Griffin hurt; Clippers hang on to beat Lakers 120-115
After the game, he left without speaking to reporters but wasn't on crutches, according to multiple reports . Blake Griffin suffered a left knee injury during Monday's win by the Clippers over the Lakers .

Huawei says it can do better than Apple's Face ID
In its place we have Face ID, which allows the tenth anniversary iPhone to be unlocked with just a glance of someone's face. The experts used a 3D mask made of stone powder, which costs roughly USA $200, as well as glued 2D images of the eyes.

France to vote against 5-year European Union renewal of glyphosate herbicide
Controversial herbicide glyphosate licensed for five more years in European Union , despite France's opposition, according to an European Union official.

Police responding to shots fired at the Galleria at Crystal Run
At least two people were injured after reports of an active shooter prompted an upstate NY mall to evacuate Sunday afternoon. Video posted to social media showed armed officers scouring the shopping mall while shoppers ran toward the exits.

HTC U11 Getting Android Oreo Update Today, Starting With Unlocked Units
HTC's Vice President of Product Management Mo Versi announced the news via his Twitter handle in the midst of Thanksgiving. The smartphone was launched with Android 6.0 Marshmallow and it was upgraded to Android Nougat towards the end of 2016.

BYU Women's Volleyball: Lucky 13 again for Cougars in NCAA Tournament
The America East champs are making their first NCAA tournament appearance after unexpectedly winning of the conference tourney. Cheers rang out when WKU's name popped up on the screen as one of four teams that will play in Lexington this weekend.

Upside-down Christmas tree returns with imitators and controversy
If the base of the tree does dry out and seal up, you will have to re-cut the base to allow it to absorb sufficient water. Depending on the variety, trees take an average of 7 to 10 years to grow. "We don't need any more rain", he said.

Dozens accuse massage therapists at national massage chain of sexual misconduct
Dozens of people have accused massage therapists of sexual misconduct at Massage Envy , according to a BuzzFeed report . The report, first written by Buzzfeed News , states that over 180 women were sexually assaulted at their locations.

See who's ecstatic over Flynn 'flipping' on Trump
It's possible that Flynn is merely in discussions with Mueller's office, and that those talks will ultimately fall through. For his part, Abramson argues the Trump-Flynn legal information-swapping was ethically dubious from the get-go. "...

South African Court Doubles Jail Sentence For Oscar Pistorius
Friday's Supreme Court decision also has possible consequences for where he is held for the remainder of his sentence. But it was still up to Masipa, the same original judge, to sentence him. "She can now rest in peace", Ms Koen said.

Other news