Hacker News Reader

Comment by ben174 | Hacker News Reader

You'd still need physical access to a logged-in machine to exploit it. I'm not sure what the latest default is as to Guest accounts and whether or not those can exploit it, but it's a significantly different story if it requires you to exploit it on an unattended logged in machine.

If guest accounts are enabled by default and a guest account can exploit it, yea.. that's pretty bad.

View on HN

> You'd still need physical access to a logged-in machine to exploit it

Not necessarily; this aspect was unfortunately underreported:

"macos 10.13 bug isn't limited to root in all circumstances; via ARD, you can log in as any existing user (e.g. _applepay) and share the screen of the logged-in user. also _uucp is allowed to log in"

https://twitter.com/unsynchronized/status/935656609140711426

The defaults don't allow for remote management, screen sharing, or SSH or anything. Most of these devices are going to be sold without those options ever being touched.

So that limits things in terms of who is affected.

None of which makes this statement any less inaccurate:

> You'd still need physical access to a logged-in machine to exploit it.

> None of which makes this statement any less inaccurate: >> You'd still need physical access to a logged-in machine to exploit it.

Yes it does; if Remote Management was enabled (as is often the case for remote servers or mass deployments), an attacker could login via Apple Remote Desktop using default, pre-existing user accounts (_applepay, _uucp, etc) and a blank password without ever needing physical access.

Just tested again with a new, unpatched install of 10.13.1 on one Mac, connecting via Screen Sharing from another. To be clear, I never logged in as root on the 10.13.1 Mac at all, even via the exploit.

You are agreeing with the comment you're replying to. He/she was saying that the defaults being what they are do not make the statement that you need physical access any less inaccurate.

Thank you for the kind correction and clarification, 59nadir. And my apologies to you, Someone1234, for having hastily misread your comment.

Just as a very simple, isolated example, think of all the Mac Mini servers with Remote Management enabled at https://macminicolo.net .

As I mentioned below, this remote exploit did NOT require ever logging in as root, whether with or without a password. This was a much more serious bug than is commonly understood.

> You'd still need physical access to a logged-in machine to exploit it.

You don't. You can exploit it from the login screen after a machine wakes from sleep, you can also exploit it remotely via Screen Sharing.

But from a shut-off machine it wasn't exploitable? Have an iMac sitting at work (turned off) and am on vacation =)

Reply on news.ycombinator.com