Apple has said it is working to fix a serious bug within its Mac operating system.
The flaw in MacOS High Sierra – the most recent version – makes it possible to gain entry to the machine without a password, and also have access to powerful administrator rights.
“We are working on a software update to address this issue,” Apple said in a statement.
The bug was discovered by Turkish developer Lemi Ergin.
He found that by entering the username “root”, leaving the password field blank, and hitting “enter” a few times, he would be granted unrestricted access to the target machine.
Mr Ergin faced criticism for apparently not following responsible disclosure guidelines typically observed by security professionals.
Those guidelines instruct security experts to notify companies of flaws in their products, giving them a reasonable amount of time to fix the flaw before going public.
Mr Ergin did not respond to those claims when asked on Twitter, and the BBC was unable to reach him on Tuesday.
Apple would not confirm or deny whether it knew about the flaw beforehand.
However, a member of Apple’s support forums had posted details of the flaw more than two weeks ago, though the message appears to suggest the vulnerability could be a useful feature for troubleshooting rather than a critical security threat.
Considering the power it gives, the bug is remarkably simple, described by security experts as a “howler” and “embarrassing”.
Those with root access can do more than a normal user, such as read and write the files of other accounts on the same machine. A superuser could also delete crucial system files, rendering the computer useless – or install malware that typical security software would find hard to detect.
Typically, the bug cannot be exploited remotely, meaning for most users the threat only exists if a malicious person has physical access to the machine. That said, if remote access has been granted to the computer for some other reason, such as offering tech support, then the flaw could be executed using that connection.
The timing of the disclosure presents a major issue to Apple as it now must hurriedly put in place a fix before the vulnerability can be exploited by criminals.
“Haste and security don’t make good bedfellows,” said Prof Alan Woodward from the University of Surrey.
“They will need to be careful the patch doesn’t introduce some other problem as they’ve not had time to properly test it.”
While Apple works on its fix, it offered a workaround for users concerned about the bug.
“Setting a root password prevents unauthorized access to your Mac,” the company explained.
“To enable the Root User and set a password, please follow the instructions here: https://support.apple.com/en-us/HT204012.
“If a Root User is already enabled, to ensure a blank password is not set, please follow the instructions from the ‘Change the root password’ section.”
Fuller instructions on how to set the root password were written up by MacRumors.
For those not confident enough to change system settings like this, security experts advise simply – don’t let your Mac out of your sight, and be sure to apply the system update when prompted.
George Holliday, who filmed Rodney King video, dies of COVID-19
Liberals win minority government in 2021 federal election
Japanese sisters certified as world’s oldest twins at 107
U.S. easing virus restrictions for foreign flights to America
Election day 2021: Canadians to decide who will lead the country
Entertainment7 days ago
George Wein, Newport Jazz Festival co-founder, dies at 95
North America7 days ago
Ontario releases new details on how people will prove their COVID-19 vaccine status starting Sept. 22
Health7 days ago
U.K. recommends COVID-19 booster shots for over 50s
Health7 days ago
Researchers to study whether COVID-19 vaccines affect women’s periods
Other7 days ago
Amazon brings palm-swiping tech to Red Rocks concert venue
U.S4 days ago
Florida surpasses 50K COVID deaths after battling Delta wave
Other5 days ago
Ozone hole over Antarctica larger than usual, scientists say
U.S5 days ago
Biden’s ‘summer of love’ with Europe hits an abrupt break-up