Apple has just released an update for the embarrassing macOS High Sierra security flaw uncovered yesterday, which would let anyone get full access to your Mac with a blank password.
Go install this macOS High Sierra update now if you want to protect your Mac, especially if it’s one that’s out in the open.
What’s even scarier about this security lapse was it was also published two weeks ago in Apple’s own Developer forums (seriously, you can’t make this stuff up.), as noted on Twitter by Mike Myers (no, not that groovy dude):
Perhaps nobody noticed two weeks ago when the root login vulnerability in macOS High Sierra was shared as a helpful tip on Apple’s own Developer forums. https://t.co/P44gEId25d pic.twitter.com/sOiRt8j2X7
— Mike Myers (@fristle) November 29, 2017
Update: Here’s Apple’s statement and apology regarding this security lapse, provided to Daring Fireball:
Security is a top priority for every Apple product, and regrettably we stumbled with this release of macOS.
When our security engineers became aware of the issue Tuesday afternoon, we immediately began working on an update that closes the security hole. This morning, as of 8:00 a.m., the update is available for download, and starting later today it will be automatically installed on all systems running the latest version (10.13.1) of macOS High Sierra.
We greatly regret this error and we apologize to all Mac users, both for releasing with this vulnerability and for the concern it has caused. Our customers deserve better. We are auditing our development processes to help prevent this from happening again.
Update 2: Apple has also posted a second update, on how to restore authenticating or connecting to file shares on your Mac–which breaks after installing this security update:
- Open the Terminal app, which is in the Utilities folder of your Applications folder.
- Type sudo /usr/libexec/configureLocalKDC and press Return.
- Enter your administrator password and press Return.
- Quit the Terminal app.
…refresh for updates.