There's a major security flaw in macOS that gives anyone admin access

Apple fixes macOS High Sierra security flaw

This gives root access to the computer - meaning a person could operate the device as if they were an administrator and could download malicious software or otherwise compromise the computer. (The company maintains an invite-only bug bounty program.) Despite its incredibly alarming simplicity, The Verge is not reproducing the steps to bypass High Sierra's login screen here.

Once the phantom account is created, a user simply needs to enter "root" as a username and, without entering a password, hit enter to unlock. After pressing Enter, they'll be logged in with full system administrator privileges.

It is possible to mitigate against the flaw, however, by adding a password for the root user in the users and groups preferences pane. Eventually the system will let you in with full access, according to security researchers.

Click the lock icon in Directory Utility's window and authenticate.

Click the lock button, then enter your username and password when prompted. I've confirmed that if you have Screen Sharing (or Remote Management) enabled in System Preferences Sharing, someone can connect to your Mac over the local network or, depending on your Internet setup, the outside world. This blocks the bug from creating another root account.




Currently, there is no official fix from Apple regarding the issue. Long term, only Apple can fix this completely, and that's why it's important to keep your system up to date.

Let us know how it goes for you, and stay tuned for Apple's macOS update soon...

A user reported the issue earlier today, but initially it wasn't specified which version of Mac OS High Sierra was affected, what machines, or anything other than what the problem was.

But that doesn't mean this is the only way this exploit might be used.

Related news:

Hot News

isis-killer-beheading-video-story-top Prince Harry and Meghan Markle's Wedding Date Has Been Announced
Nov 29, 2017 - 01:07
Harry's great-grandparents, King George VI and Queen Elizabeth , the Queen Mother, are buried at the chapel. He said the couple were delighted to be holding the wedding in the "beautiful grounds of Windsor".

isis-killer-beheading-video-story-top Black Friday indeed: for retail the pain is just starting
Nov 29, 2017 - 01:07
My third and fourth picks to play the possibility of a mini-retail recovery through the holidays return to a more general theme. The sales bonanza that kicks off the day after Thanksgiving is now a four-day long event culminating in so-called Cyber Monday.

isis-killer-beheading-video-story-top Industrial Strategy includes £170m for construction sector
Nov 29, 2017 - 01:05
Britain launched an industrial strategy on Monday as it prepares to leave the European Union and faces uncertain economic prospects.

isis-killer-beheading-video-story-top Russian intercept of US Navy plane causes 'violent turbulence'
Nov 29, 2017 - 01:02
In June, the pilot of a U.S. bomber filmed the nail-biting moment a Russian fighter jet swooped alongside him over the Baltic Sea. P-8A Poseidon did nothing to provoke the maneuver, defense spokesperson Michelle Baldanza told the Daily News.

isis-killer-beheading-video-story-top Eight Big Ten Volleyball Teams Selected to NCAA Tournament
Nov 28, 2017 - 01:19
In fact, UCLA has hosted area-rivals Lipscomb and Murray State in the previous two season's NCAA Tournament opening-round matches. I know this team is having a blast and we don't want the season to end. "It made a lot of sense with the way things laid out".

isis-killer-beheading-video-story-top European Union condemns Russian 'foreign agent' media law as 'threat'
Nov 28, 2017 - 01:15
The bill is based on the 2012 law that forced NGOs to adopt a "foreign agent" label if they receive funding from overseas . The U.S. government-funded Voice of America and Radio Free Europe/Radio Liberty were among those on the list.

isis-killer-beheading-video-story-top Jennifer Lawrence freaks out meeting RHOBH star Lisa Rinna
Nov 28, 2017 - 01:10
Actress Jennifer Lawrence has reportedly parted ways with filmmaker Darren Aronofsky after dating him for nearly a year. Jennifer Lawrence attends the 'Mother!' UK premiere at Odeon Leicester Square on September 6, 2017 in London, England.

isis-killer-beheading-video-story-top Ivanka Trump to visit Hyderabad tomorrow
Nov 28, 2017 - 01:07
Approximately one-third of the entrepreneurs are from the U.S. , one third from India and the remaining from other countries. Ten countries, including Afghanistan and Saudi Arabia, are sending all female delegations.

isis-killer-beheading-video-story-top Everybody Is Talking About What Happened Between Klopp And Mane
Nov 27, 2017 - 01:49
Today, I didn't think for a second after the game about Manchester City; what I really thought was that we should have won the game.

isis-killer-beheading-video-story-top That's your job: CNN to Donald Trump
Nov 27, 2017 - 01:41
During his recent Asia trip, he tweeted that he was "forced to" watch "fake" CNN, claiming that he has not done so in months. This week, the Department of Justice challenged a merger between AT&T and Time Warner, which owns CNN.

isis-killer-beheading-video-story-top Wild Melee Breaks Out Between Raiders and Broncos
Nov 27, 2017 - 01:35
A host of Broncos came to Talib's defense, despite the fact that Talib had managed to work his way on top of Crabtree. The fight broke into an all-out brawl after players from both teams rushed in to defend their teammates.

isis-killer-beheading-video-story-top Tom Baker returns for surprise Doctor Who cameo
Nov 27, 2017 - 01:23
The parts not filmed in 1979 will be completed using animation and Baker's voice, but he has also filmed a live action scene. Mr Baker played the time lord for seven consecutive seasons, making him the longest-serving Doctor.

isis-killer-beheading-video-story-top Hike in fares will kill Delhi Metro, says Arvind Kejriwal
Nov 26, 2017 - 01:41
The Arvind Kejriwal-led AAP government has mounted a stiff opposition to the hike, leading to a confrontation with the Centre. At that point in time, the minimum fares were raised from Rs 8 to Rs 10 and the maximum from Rs 30 to Rs 50.

isis-killer-beheading-video-story-top San Antonio Spurs vs Charlotte Hornets: Lineups, preview and prediction 11/25/17
Nov 26, 2017 - 01:40
Pistons 99, Thunder 98: Andre Drummond had 17 points and 14 rebounds and visiting Detroit overcame a 15-point deficit. The Cavs will be back in action on Monday night, when they travel to Philadelphia for a match-up against the Sixers.

isis-killer-beheading-video-story-top Kliff Kingsbury to return as Texas Tech coach
Nov 26, 2017 - 01:36
Last year, the Red Raiders went 5-7, fueling speculation that Kingsbury was coming into the 2017 campaign on the hot seat. Ehlinger passed for 239 yards and a touchdown but the Texas offense slogged through most of the final three quarters.