High Sierra App Store system preferences unlockable with any password

MacOS 10.13 High Sierra Update: Security Bug Allows Settings Changes Without Password

MacOS 10.13 High Sierra Update: Security Bug Allows Settings Changes Without Password

Earlier this week, a bug was reported on the Open Radar platform which gave a detailed description of an issue discovered on macOS High Sierra version 10.13.2. The folks at MacRumors report they were able to successfully bypass the real password by following the above steps on an administrative account, but were not able to trick any other System Preferences login prompts with a bogus password.

Experts say it is limited to the App Store and presents a relatively limited security risk.

According to the bug report, users can simply open System Preferences, go to App Store settings and check the padlock icon.

Using the fault, they could disable automatic security updates to take advantage of system vulnerabilities that are regularly patched in the future.

There is a security flaw in the most recent edition of macOSHigh Sierra, version 10.13.2, that allows users to unlock the App Store menu in System Preferences without knowing the password.

Past year some of you might recall that Apple's macOS High Sierra had a security flaw/bug which allowed users to gain admin access without the need for a password. Enter any username and password you want and press Unlock and the App Store system preferences will become unlocked.

In November, Apple had to patch a vulnerability that allowed access to the root superuser account with a blank password.

Numerous settings within the App Store System Preferences window are also protected behind your Apple ID password and can't be changed using this method, but a nefarious user with physical access to your Mac could toggle the options that fall under the automatic update section.

The discovery no doubt brings back memories of the infamous bug that allowed anyone with root access to a device to log in with the least of a hindrance.

'Our customers deserve better. The bug was spotted by MacWorld, which also notes that it's most likely the bug will be fixed in the next update as users running the 10.13.3 beta haven't been able to reproduce it.

Recommended News

  • Trump comments on NAFTA negotiations

    Trump comments on NAFTA negotiations

    Canadian officials said this week there's an increased likelihood Trump will follow through on his exit threat. She said the government is treating the USA threat seriously.
    New Set Photos Arrive For Avengers 4 (POSSIBLE SPOILERS)

    New Set Photos Arrive For Avengers 4 (POSSIBLE SPOILERS)

    It has been widely speculated that the Avengers would not be able to defeat Thanos (Josh Brolin) in the traditional way. The Avengers could go full Doc and Marty and stir up some trouble in the past.
    Bortles gets playoff win for Jaguars

    Bortles gets playoff win for Jaguars

    He will need to keep Campbell out of Ben Roethlisberger's way and will need to block him to keep him at bay in the running game. It was the inability of the Steelers defense to play gap control defense plugging their run fits with any consistency.
  • H&M Under-Fire for Racist Ad

    H&M Under-Fire for Racist Ad

    National Basketball Association star LeBron James , rapper Diddy and other artists have also responded with outrage to the image. They also issued a second apology on their website, stating their regret of letting a black child model the hoodie in question.
    Dolly Parton drops 'Dixie' from Stampede dinner show amid

    Dolly Parton drops 'Dixie' from Stampede dinner show amid "changing attitudes"

    In a piece for Slate , writer Aisha Harris panned the show as making light of the Civil War. Dolly Parton's Dixie Stampede will have a new name when it opens for the 2018 season.
    Fiat Chrysler to move plant from Mexico to MI , pay out bonuses

    Fiat Chrysler to move plant from Mexico to MI , pay out bonuses

    The Italian-American automaker will pay each USA hourly and salaried employee a $2,000 bonus in the second quarter of 2018. The move is expected to create more than 2,500 jobs in the Detroit area by 2020.
  • Domino's turnaround genius to step down in June

    Domino's turnaround genius to step down in June

    The stock of Yum! The stock of QUALCOMM Incorporated (NASDAQ:QCOM) has "Buy" rating given on Thursday, January 28 by Rosenblatt. Korea Invest stated it has 0.02% of its portfolio in Domino's Pizza, Inc . (NYSE: DPZ ) rating on Tuesday, April 12.
    CES unplugged: electronics show hit by power outage

    CES unplugged: electronics show hit by power outage

    Even still, at least the power was restored shortly thereafter. "If our extension cord went over there we'd be out of power". In the meantime, feel free to point out all of the applicable metaphors to the current state of the electronics industry.
    Everton in talks with Arsenal over Theo Walcott transfer, says Sam Allardyce

    Everton in talks with Arsenal over Theo Walcott transfer, says Sam Allardyce

    We are short of goals so to add power in our goalscoring ability would be very important for me if we can negotiate that transfer'.
  • GM plans autonomous auto  with no wheels or pedals for 2019

    GM plans autonomous auto with no wheels or pedals for 2019

    However, the Detroit automaker has been gearing up to see its last date of deploying an autonomous ride-hailing fleet next year. The company declined to identify the first states in which it plans to launch the vehicle or say when it would begin testing.
    LeBron James, Stephen Curry lead NBA All-Star voting in second fan returns

    LeBron James, Stephen Curry lead NBA All-Star voting in second fan returns

    For the last two frontcourt spots, I chose Anthony Davis who is now second in frontcourt voting and Pual George. The players polling the most outright votes in each conference will be selected as captains .
    Chrissy Teigen defends Oprah against Seal's Harvey Weinstein accusation

    Chrissy Teigen defends Oprah against Seal's Harvey Weinstein accusation

    And hashtag real-talk for a second, we all know what would happen to any one of those power abusers if they looked like me'. Winfrey's powerful Golden Globe speech also addressed speculation that she might run for 2020 presidential election.

We are pleased to provide this opportunity to share information, experiences and observations about what's in the news.
Some of the comments may be reprinted elsewhere in the site or in the newspaper.
Thank you for taking the time to offer your thoughts.