The Root Password Hack Explained

So I've been getting a lot of questions about this root password hack that people have been talking about in the news. It's not as dangerous as it sounds. The important thing to realize is that somebody needs physical access to your Mac. You need to be sitting down at your keyboard for this to get them anywhere. So unless somebody breaks into your house or steals your MacBook or something like that then it's not an issue. 

A lot of the news reports make it seem a lot worse than that but needing physical access, well if they have physical access to your Mac there's already a whole bunch of problems you've got. So here's how it works.

I'm in Mac OS High Sierra using version 10.13.1. So I'm going to go into System Preferences and then I'm going to go to some place where I need to authenticate. So Users and Groups, I'll choose that. Authenticate means click this padlock to give you access to more things. So I'll click the padlock. It asks me for user name and password. This should be the second time you need to enter your password because you need it to enter it in in order to get access to your Mac in the first place. But it does this to be extra secure in case somebody came and sat down at your Mac that has physical access while you're logged in. 

Now you have to change the user name to root. R O O T. And the password to nothing. You actually have to click in the field. At least that's what I hear. Then click unlock. It usually doesn't even work the first time. But in this case it worked the second time. What that did was it enabled the root user, so a user with the name root and a blank password. Now that that's done somebody could actually log in using root and a blank password and do anything they want to your Mac. 

Of course they are already logged in here when they're doing this so there's already a lot they can do to your Mac and you already have problems if they're even that far that they could have done that. Now there are reports that this can happen even in the login screen. So if they're not logged in. So they have physical access to your Mac but they're logged out. But I haven't been able to replicate that. However, enough reports are out there people saying they can do that even though there's at least one major site that says  that you can't do it in the login screen. So it's a little confusing. Maybe it's because I've got FireVault enabled. Maybe some other things I've got set that I can't do it and a lot of people can't do it. 

So it's debatable whether or not you can get in if you have physical access but aren't logged in. You can definitely do it if you have physical access and are already logged in as I just did it. So let me show you how you can completely disable this so it doesn't even work. You don't have to wait for Apple to update a patch which probably will come out in the next few days. It can be even later today. 

So let's start over again. You want to just disable this to protect yourself. You're going to go to System Preferences. Then you're going to go to Users and Groups. Next you're going to click Login Options. Now all this is grayed out. Because you need to authenticate. Click the padlock and authenticate with your account password. 

Now that you've authenticated you have access to all of these controls. The one you want is the Join button. When that comes up don't worry about the actual join functionality. You're just going to hit this Open Directory Utility button. This launches another app. Now I could've skipped a lot of this and gone directly to the Directory Utility app. You can run it. You can find it in Spotlight and everything. But most people seem to be showing it this way through System Preferences so I'll do that as well. 

Now you're going to want to click the padlock again to authenticate one more time. Now that you've authenticated that padlock is unlocked. Again you don't want to do anything here in Directory Utility. You're actually  looking for the special commands under Edit. One is called Enable Root User. So you want to enter a password here. So create a password. Make sure it's secure. Some random numbers and letters. The great thing is you don't actually need to remember this password. Why? Because you can always return here using your Admin password and change the Root User Password without knowing the original and disable the root user completely. So if you forget the password it's no big deal. So you write it down somewhere and don't worry about it. 

Now that you've done this, now that you've set a root user password, now you're protected. Nobody can use this exploit because there's already a root user password set. A blank won't work. So this is the work around. So just do this if you're concerned but  of course again is somebody has physical access to your Mac then you've got other concerns besides this. I kind of equate this to if you have a safe in your house and you suddenly find out that it's easy to open the safe without knowing the combination. But somebody still needs to break into your house in order to get access to the safe. So you can see how it's maybe not that big of a concern that you want to fix it right away before doing anything else. Apple is probably going to come out with a patch for this really quickly since it's such a big news item. A lot of big scary news headlines even though it's really not that scary of a hack.