A newly discovered bug in macOS High Sierra enables the root superuser on a Mac with a blank password and no security check, essentially giving anyone full access to your Mac.
Apple is likely already working on a fix, but in the meantime, there's a temporary workaround -- enabling the root user with a password. Here's how:
From there, you can enter a password for the root user account, which prevents it from being accessed with a blank password, which is what the current bug allows to happen.
Disabling the root user account again follows the same steps, but at the "Edit" portion of the process, you'll select "Disable Root User" to remove the option. Until the bug is fixed, though, you'll want to leave the root user account intact to prevent it from being accessed without a password.
To further protect your Mac, you can also disable guest accounts, though this is not a necessary step with a root password enabled. Guest accounts can be disabled by going to System Preferences > Users & Groups and choosing "Guest User" after entering your admin password. Disable "Allow guests to log in to this computer."
Update: Apple has released a security update to fix this issue, and all macOS High Sierra users should apply the update as soon as possible to ensure they are protected.
Apple is likely already working on a fix, but in the meantime, there's a temporary workaround -- enabling the root user with a password. Here's how:
- Open Spotlight and search for Directory Utility.
- Double click on the app result to open.
- Click on the lock at the bottom of the window to make changes and enter your username and password for an administrator account on your computer.
- In the menu bar at the top of the screen, choose "Edit."
- Select "Enable Root User."
From there, you can enter a password for the root user account, which prevents it from being accessed with a blank password, which is what the current bug allows to happen.
Disabling the root user account again follows the same steps, but at the "Edit" portion of the process, you'll select "Disable Root User" to remove the option. Until the bug is fixed, though, you'll want to leave the root user account intact to prevent it from being accessed without a password.
To further protect your Mac, you can also disable guest accounts, though this is not a necessary step with a root password enabled. Guest accounts can be disabled by going to System Preferences > Users & Groups and choosing "Guest User" after entering your admin password. Disable "Allow guests to log in to this computer."
Update: Apple has released a security update to fix this issue, and all macOS High Sierra users should apply the update as soon as possible to ensure they are protected.
Related Roundup: macOS High Sierra
82 comments
Rogue Amoeba developer Quentin Carnicelli, who works on Mac software like Airfoil, Audio Hijack, Loopback, and Fission, this week penned a critique of Apple's Mac lineup and the company's...
Apple has hired Jaime Waydo, an autonomous vehicle expert who previously worked as a senior engineer at Google's Waymo, reports The Information. An Apple spokesperson confirmed the hiring, but...
Apple has formed a multi-year production partnership with Oprah Winfrey to create shows for a new video subscription service that is in the works, reports The Wall Street Journal.
Apple and...
Apple is widely rumored to introduce three new iPhone models in September, including a second-generation iPhone X, a larger version dubbed the iPhone X Plus, and a lower-priced but lesser-featured...
If you are attempting to navigate with Apple Maps right now, you may be unable to do so, as the service appears to be experiencing downtime.
"Directions Not Available," the app says,...
Ahead of the HomePod launching in Canada, France, and Germany in three days from now, the speaker has gained the ability to read the news in those countries.
Siri can now provide news briefs...
Apple today launched a new ad campaign focused on the Mac, carrying the tagline "Behind the Mac" and highlighting a trio of creators who have used Macs to "make something wonderful."...
watchOS 5, the operating system that runs on the Apple Watch, was introduced last week alongside iOS 12 and macOS Mojave. The update doesn't include design changes or new watch faces, but it does...
