accord wire hackable security flaw software even require hack knock door ask let apple macos high sierra second kind.on tuesday security researchers disclose bug allow anyone blindingly easy method break operate system security protections anyone hit prompt high sierra ask username password log machine multiple users simply type root username leave password field blank click unlock twice immediately gain full access.in word bug allow rogue user get slight foothold target computer gain deep level access computer know root privilege malware design exploit trick could also fully install deep within computer password require always see malware try escalate privilege get root access say patrick wardle security researcher synack best easy way ever get root apple hand silver platter word security vulnerability ripple across twitter social media security researchers find replicate issue others capture post video demonstrations attack like wardle gif another show security researcher amit serper log logged-out account wire also independently confirm bug.watch two incredible videos post twitter let apple know huge security issue macos high sierra pic.twitter.com/4tbh5netis patrick wardle patrickwardle november 28 2017just test apple root login bug log root even machi reboot pic.twitter.com/fthz7nkcup amit serper 0xamit november 28 2017the fact attack could use logged-out account raise possibility someone physical access could exploit easily malware point thomas reed apple-focused security researcher malwarebytes could instance use attack gain root access logged-out machine set root password regain access machine time oooh boy doozy say reed someone mac sit desk office could come back late whatever want facebook user brian matiash tell mac users protect mac hack confirm deny advice legit simply share matiash give facebook users follow advice wonder never cease apple painfully obvious bug like make qa team least make default root password password something ffs guy get damn act together edit would socially responsible state fairly easy workaround start open terminal.app type follow command sudo passwd -u root next enter primary user password enter new password root retype confirm protect function id var js fjs d.getelementsbytagname d.getelementbyid id return js d.createelement js.id id js.src 'https //connect.facebook.net/en_us/sdk.js xfbml=1 version=v2.11 fjs.parentnode.insertbefore js fjs document 'script 'facebook-jssdk wonder never cease apple painfully obvious bug like make qa team least make default root password 'password something ffs guy get damn act together.edit would socially responsible state fairly easy workaround start open terminal.app type follow command sudo passwd -u rootnext enter primary user password enter new password root retype confirm 're protected.posted brian matiash tuesday november 28 2017reed also note however researchers confirm possible block attack either set password root user disable root access altogether instal high sierra set root password disable root access now.in statement apple confirm problem reiterate short-term fix promise longer-term software patch work software update address issue apple spokesperson write yikes stun videos show anyone hack macos high sierra type one word