A newly discovered bug in macOS High Sierra enables the root superuser on a Mac with a blank password and no security check, essentially giving anyone full access to your Mac.
Apple is likely already working on a fix, but in the meantime, there's a temporary workaround -- enabling the root user with a password. Here's how:
From there, you can enter a password for the root user account, which prevents it from being accessed with a blank password, which is what the current bug allows to happen.
Disabling the root user account again follows the same steps, but at the "Edit" portion of the process, you'll select "Disable Root User" to remove the option. Until the bug is fixed, though, you'll want to leave the root user account intact to prevent it from being accessed without a password.
To further protect your Mac, you can also disable guest accounts, though this is not a necessary step with a root password enabled. Guest accounts can be disabled by going to System Preferences > Users & Groups and choosing "Guest User" after entering your admin password. Disable "Allow guests to log in to this computer."
Update: Apple has released a security update to fix this issue, and all macOS High Sierra users should apply the update as soon as possible to ensure they are protected.
Apple is likely already working on a fix, but in the meantime, there's a temporary workaround -- enabling the root user with a password. Here's how:
- Open Spotlight and search for Directory Utility.
- Double click on the app result to open.
- Click on the lock at the bottom of the window to make changes and enter your username and password for an administrator account on your computer.
- In the menu bar at the top of the screen, choose "Edit."
- Select "Enable Root User."
From there, you can enter a password for the root user account, which prevents it from being accessed with a blank password, which is what the current bug allows to happen.
Disabling the root user account again follows the same steps, but at the "Edit" portion of the process, you'll select "Disable Root User" to remove the option. Until the bug is fixed, though, you'll want to leave the root user account intact to prevent it from being accessed without a password.
To further protect your Mac, you can also disable guest accounts, though this is not a necessary step with a root password enabled. Guest accounts can be disabled by going to System Preferences > Users & Groups and choosing "Guest User" after entering your admin password. Disable "Allow guests to log in to this computer."
Update: Apple has released a security update to fix this issue, and all macOS High Sierra users should apply the update as soon as possible to ensure they are protected.
82 comments
U.S lawmakers on Friday sent a letter to Apple CEO Tim Cook expressing concern over Apple's decision to remove the HKMap Live app from the App Store after complaints from the Chinese Government.
...
While the status of Apple's electric vehicle plans are unclear at this point, hit-or-miss DigiTimes reports that Taiwanese manufacturer Quanta Computer is currently supplying Apple with...
Icons possibly depicting the widely rumored 16-inch MacBook Pro have been uncovered by French blog MacGeneration in the first two betas of macOS Catalina version 10.15.1, which has been in testing...
Apple CEO Tim Cook this week tweeted in support of the Fairness for High-Skilled Immigrants Act, urging the U.S. Senate to move quickly to pass the bipartisan bill, which would eliminate per-country...
Apple TV+ comedy series "Dickinson" made its global premiere on Thursday evening at St. Ann's Warehouse in Brooklyn.
Created, written, and executive produced by Alena Smith, the...
Google has ignited security concerns over the facial authentication system in its new Pixel 4 smartphone by admitting that it will unlock the device even when the user's eyes are shut.
...
Apple's rumored next-generation noise-canceling AirPods will launch at the end of this month with a new "Pro" moniker and a price tag of around $260, claims a new Chinese-language...
On Tuesday, Apple's Beats brand introduced the new Beats Solo Pro headphones, the company's first on-ear headphones with active noise cancellation. The new $300 headphones don't...
