For those MAC users running High Sierra

[nightshade00013]

You have a major bug that allows anyone who knows about it to login as an ADMIN without a password.


https://arstechnica.com/information...ou-log-in-as-admin-with-no-password-required/

In one of Apple's biggest security blunders in years, a bug in macOS High Sierra allows untrusted users to gain unfettered administrative control without any password.

The bypass works by putting the word "root" (without the quotes) in the user name field of a login window, moving the cursor into the password field, and then hitting enter button with the password field empty. With that—after a few tries in some cases—the latest version of Apple's operating system logs the user in with root privileges. Ars reporters were able to replicate the behavior multiple times on three Macs. The flaw isn't present previous macOS versions.

 

[Ericloewe]

*sad tuba*

 

[fracai]

And setting a root password isn't enough as it seems to impact other system accounts as well.

https://twitter.com/unsynchronized/status/935656609140711426

 

[fracai]

And the fix is out: https://support.apple.com/en-us/HT208315