Hacker News Reader

Comment by DCKing | Hacker News Reader

Not behind a Mac at the moment, but I wonder if this means you can also enable a set of other standard disabled Unix accounts on a Mac?

That will worsen the impact even more, I'd say. Being able to enable disabled accounts my (locally or remotely) authenticating to a Mac system is very bad, even if those accounts are not root.

View on HN

I pulled the list from /etc/passwd and have tried a bunch, but none worked. The root trick worked on this machine, so I know it's vulnerable. I have not tried them all.

The vast majority of those usernames start with an underscore. Not sure if that matters. The trick didn't work for "daemon" and "nobody" either, though.

I think there has to be some special weirdness about how root is disabled on Macs. It's the only account with its own "Enable.." line in the Directory Utility menu, for example.

So at first blush this seems limited to root, but I'm not going to hold myself out as a macOS expert. Just someone with a Mac I don't mind trying to bork.

There is a tweet that claims it also worked against _uucp, and (perhaps more concerningly) against _applepay:

https://twitter.com/unsynchronized/status/935656609140711426

Yes, the exploit works (or worked, now that the patch is out) against any passwordless system account. You won’t get the same feedback as it won’t unlock the prefpane, but they will have the password set, allowing you to change the shell and log in.

Reply on news.ycombinator.com