Skip to main content

[Bug] macOS High Sierra App Store Preferences Can Be Unlocked Without a Password


Yet another password vulnerability has been uncovered in macOS High Sierra, which unlocks App Store System Preferences with any password (or no password at all).

A new password bug has been discovered in the latest version of macOS High Sierra that allows anyone with access to your Mac to unlock App Store menu in System Preferences with any random password or no password at all.

The impact of this vulnerability is nowhere as serious as the previously disclosed root login bug in Apple's desktop OS that enabled access to the root superuser account simply by entering a blank password on macOS High Sierra 10.13.1.

As reported on Open Radar earlier this week, the vulnerability impacts macOS version 10.13.2 and requires the attacker to be logged in with an administrator-level account for this vulnerability to work.

I checked the bug on my fully updated Mac laptop, and it worked by entering a blank password as well as any random password.

If you're running latest macOS High Sierra, check yourself:
  • Log in as a local administrator
  • Go to System Preferences and then App Store
  • Click on the padlock icon (double-click on the lock if it is already unlocked)
  • Enter any random password (or leave it blank) in login window
  • Click Unlock, Ta-da!

Once done, you'll gain full access to App Store settings, allowing you to modify settings like disabling automatic installation of macOS updates, app updates, system data files and even security updates that would patch vulnerabilities.

We also tried to reproduce the same bug on the latest developer beta 4 of macOS High Sierra 10.13.3, but it did not work, suggesting Apple probably already knows about this issue and you'll likely get a fix in this upcoming software update.

What's wrong with password prompts in macOS? It's high time Apple should stop shipping updates with such an embarrassing bug.

Apple also patched a similar vulnerability in October in macOS, which affected encrypted volumes using APFS wherein the password hint section was showing the actual password of the user in the plain text.

 More Links:



Labels:
Location: United States

Comments

Post a Comment

Popular posts from this blog

iOS 11.3 coming this spring with battery and performance settings, ARKit 1.5, new Animoji

In a sign that Apple will continue to update iOS regularly instead of withholding features for its next major point-zero release, Apple on Wednesday revealed new features coming to an iOS 11.3 update this spring, including the ability to toggle the power management feature for iPhone models with aging batteries. Apple will implement new battery health information and the ability to customize power settings after it was revealed that the company  throttles CPU performance on older devices  where the battery is deteriorating. Apple's throttling is done to prevent random shutdowns of the device and ensure smooth operation, but some customers took offense to the fact that the slowdowns were occurring without transparency to the user. In a press release issued on Wednesday, Apple said that the iOS 11.3 update this fall will show battery health, and recommend to users if their battery needs to be serviced. The capabilities will be available for iPhone 6 and later. Users will...
Post a Comment
Read more

DJI Spark vs. Parrot Bebop 2 Which One Is The Best

It's a Parrot vs DJI drone showdown Earlier this year, DJI announced it would be taking on the entry-level, selfie drone market with its  Spark . Along with challengers like the  Yuneec Breeze , the smallest DJI quadcopter is priced within touching distance of the bigger  Parrot Bebop 2 . How do they compare? Weight The Bebop is significantly heavier than the Spark, but that extra weight is an advantage in some ways. More on that in a minute. Battery Parrot has slotted a big battery into the Bebop 2 – the original Bebop had an 1100 mAh unit, compared to the 2700 mAh pack in the latest Bebop 2. That translates to a healthy flight time, too. Flight Time Parrot has a massive advantage over DJI when it comes to flight time. The bigger battery in the Bebop affords it a healthy 25 minute flight time, compared to 16 minutes for the Spark. The heavier Parrot drone is also likely to stand up better to buffeting in high winds. Range Both d...
Post a Comment
Read more

12 Android Oreo Hidden Features You Can Try

lthough I have a special place in my heart for this mobile operating system, I won’t say I am aware of every hidden Android feature that exists. But still, people who own a device want to explore it to the fullest. The same might go for most of the users. Being an owner of a Moto device, I am apparently deprived of the Android O update. But thanks to a friend of mine who lent me his expensive Pixel, I got to have a hand on the latest dessert from Google. Android’s most recent upgrade now runs on only 1.1% of Android devices worldwide, as per the numbers released by Google in February 2018. Certainly, it is an improvement over Nougat with features like Picture-in-Picture, system-wide autofill functionality, and Notifications improvements, and additional developments like Project Trebble. But people always have the urge find what they prefer to call hidden Android features. Personally, it has been hard for me to digest the term, as most of them are a few taps awa...
Post a Comment
Read more