MacRumors

There appears to be a serious bug in macOS High Sierra that enables the root superuser on a Mac with a blank password and no security check.

The bug, discovered by developer Lemi Ergin, lets anyone log into an admin account using the username "root" with no password. This works when attempting to access an administrator's account on an unlocked Mac, and it also provides access at the login screen of a locked Mac.

To replicate, follow these steps from any kind of Mac account, admin or guest:

1. Open System Preferences
2. Choose Users & Groups
3. Click the lock to make changes
4. Type "root" in the username field
5. Move the mouse to the Password field and click there, but leave it blank
6. Click unlock, and it should allow you full access to add a new administrator account.

At the login screen, you can also use the root trick to gain access to a Mac after the feature has been enabled in System Preferences. At the login screen, click "Other," and then enter "root" again with no password.

This allows for admin-level access directly from the locked login screen, with the account able to see everything on the computer.

It appears that this bug is present in the current version of macOS High Sierra, 10.13.1, and the macOS 10.13.2 beta that is in testing at the moment. It's not clear how such a significant bug got past Apple, but it's likely this is something that the company will immediately address.

Until the issue is fixed, you can enable a root account with a password to prevent the bug from working. We have a full how to with a complete rundown on the steps available here.

Update: An Apple spokesperson told MacRumors that a fix is in the works:

"We are working on a software update to address this issue. In the meantime, setting a root password prevents unauthorized access to your Mac. To enable the Root User and set a password, please follow the instructions here: https://support.apple.com/en-us/HT204012. If a Root User is already enabled, to ensure a blank password is not set, please follow the instructions from the 'Change the root password' section."

Update 2: Apple released a security update to address the vulnerability on Wednesday morning. The update can be downloaded on all machines running macOS 10.3.1 using the Software Update mechanism in the Mac App Store. Apple says it will automatically push out the update to all users who have not installed it later in the day.

In a statement provided to MacRumors, Apple said the company's engineers began working on a fix as soon as the problem was discovered. Apple also apologized for the vulnerability and said its development process is being audited to prevent something similar from happening in the future.

Security is a top priority for every Apple product, and regrettably we stumbled with this release of macOS.

When our security engineers became aware of the issue Tuesday afternoon, we immediately began working on an update that closes the security hole. This morning, as of 8 a.m., the update is available for download, and starting later today it will be automatically installed on all systems running the latest version (10.13.1) of macOS High Sierra.

We greatly regret this error and we apologize to all Mac users, both for releasing with this vulnerability and for the concern it has caused. Our customers deserve better. We are auditing our development processes to help prevent this from happening again.

All users should download the new security update immediately.

Apple today seeded the fifth beta of an upcoming iOS 11.2 update to developers, more than a week after releasing the fourth iOS 11.2 beta, a month after releasing the first major iOS 11 update, iOS 11.1, and a week and a half after releasing the iOS 11.1.2 update.

Registered developers can download the new iOS 11.2 beta from Apple's Developer Center or over-the-air once the proper configuration profile has been installed from the Developer Center.

iOS 11.2 introduces Apple Pay Cash, Apple's new peer-to-peer payments service. Apple Pay Cash works through the Messages app and is designed to allow for quick person-to-person money transfers. It's available as a dedicated iMessage app in Messages, with cash transferred through the app.

Cash can be sent from a linked debit or credit card, while received cash is stored in an Apple Pay Cash card in Wallet that can be used for purchases or sent to a bank account.

On the iPhone X, iOS 11.2 adds a small bar underneath the icons located at the upper right side of the device on the Lock screen, which is designed to make the location of the Control Center gesture more clear. On the iPhone X, Control Center is accessed by swiping down from the top of the device.

In Control Center on all devices, there are two new informational pop-ups that are displayed when using the Wi-Fi or Bluetooth toggles. These pop-ups explain that Bluetooth and Wi-Fi are disabled temporarily rather than permanently when accessed from Control Center.

In iOS 11.2, there's support for faster 7.5W wireless charging for the iPhone X, iPhone 8, and iPhone 8 Plus. The faster speeds will be available when using third-party wireless chargers that support 7.5W charging or more.

The update also addresses an animation bug in the Calculator app that caused some numbers and symbols to be ignored when entered in rapid succession. The update removes the animations from the calculator app so calculations can be done quickly with no need to pause between entering numbers to obtain the correct result.

In addition to these bug fixes, iOS 11.2 introduces a new Now Playing option for controlling content on the Apple TV in Control Center, redesigned camera emoji, a new loading animation for Live Photos effects, and new Live wallpapers for the iPhone X, plus it adds a feature that lets developers offer new customers discounted introductory pricing for auto-renewable subscriptions on the App Store.

Update: Apple has also seeded a new version of iOS 11.2 for public beta testers.

Yesterday was Cyber Monday, an annual shopping event in the United States, United Kingdom, and many other countries that's part of the holiday shopping season and offers users notable discounts on a vast array of consumer products. Last night, Adobe released its online shopping data for this year's Cyber Monday, stating that November 27, 2017 is projected to set a new record and become the "largest online sales day in history" with a total of $6.59 billion spent by the day's end.

Compared to 2016, Cyber Monday 2017 saw a 16.8 percent year-over-year increase in sales, and it fared better in revenue compared to last week's big shopping days: Black Friday 2017 brought in $5.03 billion and Thanksgiving Day brought in $2.87 billion. Adobe's statistics leveraged Adobe Sensei and Adobe Analytics to analyze data from one trillion visits to over 4,500 retail sites and 55 million SKUs. Of all these data points, Apple and its products were found at the top of a few lists.

The AirPods were listed as overall top sellers yesterday, while iPads were included in the best-selling electronics category, alongside AirPods again, Google Chromecast, Samsung Tablets, Nintendo Switch, and more. In terms of discounts, Walmart was one of very few retailers with a brief sale on AirPods yesterday, marking the $159.00 earphones down by $15. Numerous retailers had sales on a variety of iPads, including the 9.7-inch iPad and 10.5-inch and 12.9-inch iPad Pro.

Shoppers on mobile helped set a new record with 47.4 percent of visits coming from mobile devices (39.9 percent on smartphones and 7.6 percent on tablets). Revenue earned from users shopping on mobile grew 39.2 percent year-over-year and reached a new all-time high of $1.59 billion. Of all mobile devices used to shop on Cyber Monday this year, iOS was in the lead with an average order value of $123, while Android was at $110.

“Shopping and buying on smartphones is becoming the new norm and can be attributed to continued optimizations in the retail experience on mobile devices and platforms,” said Mickey Mericle, vice president, Marketing and Customer Insights at Adobe.

“Consumers are also becoming more savvy and efficient online shoppers. People increasingly know where to find the best deals and what they want to purchase, which results in less price matching behavior typically done on desktops. Millennials were likely another reason for the dramatic growth in mobile, with 75 percent expecting to shop via their smartphone."

The biggest discounts were for TVs (21.1 percent off of the normal price on average), toys (18.8 percent), and computers (14.7 percent). In total, the 2017 holiday shopping season so far (marked as beginning on November 1) has seen a total of $50 billion in online revenue, jumping up 16.8 percent from 2016. According to Adobe, "this will be the first-ever holiday season to break $100 billion in online sales."

If you were planning to purchase a new Apple TV 4K with 64GB of storage from Apple in time for the holidays, you may have to look elsewhere.

As spotted on Reddit, the 64GB model is currently out of stock at most Apple retail stores, and estimated to ship in 4-5 weeks on Apple's online store around the world. Orders placed today might not be delivered until as late as early January.

The reason for the delay is unknown. Lengthy shipping estimates can sometimes foreshadow a product refresh, but the Apple TV 4K was just released in late September, so it's unlikely a new model is on the horizon.

Notably, the 32GB model is still available for pickup at most Apple retail stores today, and estimated to ship in approximately one week on Apple's online store in the United States and over a dozen other countries we checked.

The latest Apple TV supports both 4K and HDR video playback. The set-top box starts at $179 in the United States.

If you are looking to purchase an Apple TV 4K with 64GB of storage, some resellers such as Best Buy, Costco, MacMall, Sam's Club, Staples, Target, and Walmart may still have stock available online or in stores.

Apple today was granted a patent originally filed in August 2016, describing a method in which users would be able to control a Mac computer -- and potentially other devices -- using a "non-tactile three dimensional (3D) user interface" (via Patently Apple). The patent's inventor credits go in part to Amir Hoffnung and Jonathan Pokrass, two current Apple employees who joined the company from PrimeSense after Apple acquired it November 2013.

Some of PrimeSense's tech, which was originally used in Microsoft's Kinect devices on Xbox platforms, now resides in the front-facing TrueDepth camera of the iPhone X, and the new patent hints at a potential future where this technology expands in function to Macs as well. Instead of recognizing faces, Apple's patent describes a Mac that recognizes a "gesture by a hand," allowing users to interact with the computer without tactile inputs like a keyboard, mouse, or trackpad.

Gestures described herein include focus gestures and unlock gestures. A focus gesture enables the user to engage (i.e., take control of) an inactive non-tactile 3D user interface. An unlock gesture enables the user to engage a locked non-tactile 3D user interface, as pressing a specific sequence of keys unlocks a locked cellular phone. In some embodiments, the non-tactile 3D user interface conveys visual feedback to the user performing the focus and the unlock gestures.

Examples of unlock gestures include an "up" gesture (e.g., raising hand 30 a specified distance), a sequence of two sequential wave gestures, and a sequence of two sequential push gestures, as described in detail hereinbelow.

Apple has previously been granted patents related to 3D sensing and gesture controls, but the company has yet to release a product that takes advantage of these features. Some of these previous patents included gesture controls on iPads and iPhones as well as on Magic Keyboards, which would allow users to gain access to virtual buttons and potentially streamline certain elements of the user interface.

Of course, with Face ID already launched on iPhone X, it's predicted that Apple will look into adding the facial recognition software into future iMacs and MacBooks before it focuses on a new unlocking system. It's also unclear whether the new 3D user interface patent would include both pieces of technology -- 3D gestures and Face ID -- to further augment a Mac's unlocking process.

As with any patent, the technology in question might not make it to an Apple product in the near future, if at all, but it is an interesting glimpse into what Apple might be planning to do with PrimeSense's technology down the line.

Apple today announced it has opened registration for free all-ages "Hour of Code" sessions between December 4 and December 10 of this year at all of its nearly 500 retail stores around the world.

Apple also introduced a new Hour of Code challenge in the Swift Playgrounds app for iPad that invites students to build a digital robot, and added new teacher resources to the Everyone Can Code curriculum to help students learn Swift.

Apple's new Everyone Can Code curriculum includes a free Hour of Code guide featuring the new Swift Playgrounds challenge to make it easy to get started teaching code in schools, community centers and after-school programs. Schools can easily host their own one-hour Hour of Code event anytime simply by downloading the Swift Playgrounds app and Hour of Code guide.

Apple has offered Hour of Code sessions for five consecutive years in celebration of Computer Science Education Week.

PDF: Hour of Code with Swift Playgrounds—The Incredible Code Machine Facilitator Guide

Apple has launched an official Apple Support YouTube channel, uploading a series of videos that cover assorted iOS tips and tricks to help out customers new to iPhone and iPad.

First noted on Reddit, the Apple Support YouTube channel was registered on October 5, but had remained dormant until yesterday when the channel was quietly populated with its first 10 short how-to videos, which are between one and two minutes in length.

The videos offer quick-fire iOS tips such as "How to send and save GIFs on your iPhone", "How to change the wallpaper on your iPhone or iPad", and "How to delete call history on your iPhone".

The Apple Support YouTube channel can be found here. And don't forget, you can also subscribe to the official MacRumors YouTube channel here.