High Sierra App Store system preferences unlockable with any password

A screenshot of the login field for the App Store preferences on a Mac. Any password will do to long into the App Store preferences on a Mac running High Sierra

This time, it is the App Store System Preferences that has been found to be accessible to anyone using any password.

Attackers could gain access to your Mac thanks to another security flaw discovered in the latest version of its operating system. On macOS 10.13.2, the App Store preferences can be unlocked using any password.

Assuming the attacker would be able to gain such access, they would still only be able to change the user's preferences in the App Store.

You will then need to lock the padlock if it is already unlocked, and then click on it again to unlock it. Flipping those settings could be used in conjunction with another attack to ensure a system wasn't patched to close a security hole, though local access or at least administrator access from a remote location are required.

With I Am Root still fresh in the memories of users and the recent hoopla over Meltdown and Spectre not yet died-down, this comes at a particularly unwelcome time. The folks at MacRumors report they were able to successfully bypass the real password by following the above steps on an administrative account, but were not able to trick any other System Preferences login prompts with a bogus password.

Bargain Hunters Should Take a Look at Domino's Pizza, Inc. (NYSE:DPZ)
After eight years with the company, Patrick Doyle plans to resign his post as president and CEO of Domino's effective June 30. Qualcomm Inc decreased its stake in Qualcomm Inc (QCOM) by 2.35% based on its latest 2017Q3 regulatory filing with the SEC.

Young Texas Church Shooting Victim Finally Returns Home after Months in Hospital
Ryland lost three of his relatives in the shooting. "It's just a miracle he survived and is doing as well as he is", she said. As it rolled down the freeway, supporters gathered on overpasses and along roads waving and smiling, and Ryland waved back.

All jewels stolen in brazen Paris Ritz robbery recovered
Three men, all aged around 30, were arrested moments after the alarms sounded after security guards trapped them in the building. Three axe-wielding thieves carried out the brazen robbery last week at the ultra-chic hotel on the city centre's Place Vendome.

The bug is nowhere near as unsafe as the root-access security flaw that was uncovered a year ago, whereby attackers could gain root access to MacOS computers by typing "root" in the username field and leaving the password field blank.

Numerous settings within the App Store System Preferences window are also protected behind your Apple ID password and can't be changed using this method, but a nefarious user with physical access to your Mac could toggle the options that fall under the automatic update section.

In order to reproduce the bug, a user can start by logging in as an admin.

Apple's Mac OS Sierra is in the news again thanks to another security loophole that has come to the fore.

'Our customers deserve better. As also reported by MacRumors, 10.13.3 has a planned release for later this month, and the bug doesn't seem present in 10.12.6 or earlier versions.

Related News:

  • Mum of boy in H&M ad brands controversy 'unnecessary'

    Mum of boy in H&M ad brands controversy 'unnecessary'

    That being said, Mango agreed that "everyone is entitled to their opinion about this", even if she happened to disagree. The first apology read "We sincerely apologize for offending people with this image of a printed hooded top".
    Infosys December quarter net profit jumps 38% to Rs 5129 crore

    Infosys December quarter net profit jumps 38% to Rs 5129 crore

    And lastly, net profit for the quarter came in 42.12% higher than the estimated figure of Rs. 3609 crores. The tax agreement will reduce Infosys's effective tax rate by 100 basis points going forward.
    Samsung Galaxy S9 Retail Box LEAKS With Spec List

    Samsung Galaxy S9 Retail Box LEAKS With Spec List

    Galaxy owners were hoping to get a sneak peek at the S9 at CES but their hopes were quickly squashed. Like its predecessor, this phone is also coming with AKG tuned earphones in the box.
  • Christian groups decry U.S.  policy change on Salvadorans as Episcopalians offer support

    Christian groups decry U.S. policy change on Salvadorans as Episcopalians offer support

    In fewer than 140 characters, the Trump administration set a date to end the dream of more than 200,000 Salvadoran families. Numerous people under the temporary status have tried to become permanent residents by applying for green cards.

    CES goes dark in the rain

    The trade fair is marketed as the "world's gathering place for all those who thrive on the business of consumer technologies ". Follow CNET's live coverage of day two of CES here. "We will continue to restrict access until full power has been restored".
    Dolly Parton's Dixie Stampede Dinner Attraction Is Losing The 'Dixie'

    Dolly Parton's Dixie Stampede Dinner Attraction Is Losing The 'Dixie'

    World Choice Investments CEO Jim Rule says the rebranding is part of an effort to "stay relevant in today's changing world". Parton opened Stampede in three different cities: Branson, Mo., Pigeon Forge, Tenn . and Myrtle Beach, S.C.
  • What Does Gerrymandering Mean? North Carolina Congressional Districts To Be Redrawn

    What Does Gerrymandering Mean? North Carolina Congressional Districts To Be Redrawn

    Supreme Court has rejected the idea that district maps should be blind to party considerations. In the 2-1 ruling on Pennsylvania's case, a judge found that the U.S.
    Curry, James lead fan voting for All-Star game

    Curry, James lead fan voting for All-Star game

    I think George will surpass Draymond Green and DeMarcus Cousins because of people liking him more than they like those two. For the last two frontcourt spots, I chose Anthony Davis who is now second in frontcourt voting and Pual George.
    Marriott forced to issue apology after China error

    Marriott forced to issue apology after China error

    Taiwan and the mainland split in 1949 after a civil war but the Communist Beijing government claims the island as its territory. Delta Air Lines Inc., the Zara apparel chain and Irish medical-equipment maker Medtronic Plc all came under fire.
  • AAP loses Vishwas, nominates Sanjay Singh, 2 others for RS

    AAP loses Vishwas, nominates Sanjay Singh, 2 others for RS

    At a press conference, he alleged that the AAP was sending N D Gupta to the Rajya Sabha with the support of the BJP. But, the party this time chose to select candidates from the field of law, economics and social work.
    Dominion Energy Pays $7.9B For Utility Co. SCANA

    Dominion Energy Pays $7.9B For Utility Co. SCANA

    SCE&G and project co-owner Santee Cooper blamed the $9 billion project failure on the bankruptcy by contractor Westinghouse. Dominion Energy Inc says that it expects the acquisition of SCANA Corporation to be immediately accretive to its earnings.
    Dolly Everett farewelled by hundreds of mourners in Katherine

    Dolly Everett farewelled by hundreds of mourners in Katherine

    Mr Everett said the family was overwhelmed and humbled by the outpouring of support. "It is sad. "May we please ask for some time to celebrate the life of our much-loved daughter Dolly".


Most liked

Stony Brook family's cruise to Bahamas rocked by winter storm
The Norwegian Cruise Line ship was sailing in the Atlantic Ocean from the Bahamas to NY when the storm hit earlier this week. Passengers have since told of how they held on for life and feared their safety as the boat was rocking "like crazy".

Firefighters battle giant blaze at Dublin metal plant
But people with breathing difficulties are being advised to avoid the area until the remainder of the smoke plume is gone. No delays have been reported and a spokeswoman for Dublin Airport confirmed the fire was not on the airport's grounds.

Liverpool vs Manchester City 14 January 2018: EPL Preview and Predictions
Gabriel Jesus could be fit for Manchester City's Champions League game against Basel on February 13, according to Pep Guardiola . Instead, I fancy the points to be shared - and with the attacking output on both sides, I think we could see a thriller.

Turkey summons U.S. envoy over Syrian issue
The drone attack on the Russian assets in Syria also raised tensions between Russia and Turkey . Syrian President Bashar al-Assad "is extremely unpopular".

Obama Foundation files plans for Obama Presidential Center
"Take a look at that, at that initial decision where they decided between Jackson Park and Washington Park". The Obama Foundation outlined the guiding principles behind the center's design in a statement Wednesday.

Falling energy prices hold United States consumer inflation to 0.1% in December
Excluding food and energy prices, core producer prices still dipped by 0.1% in December following a 0.3% increase in November. USA energy prices were up sharply a year ago compared to 2016, with petrol rising almost 11% and fuel oil up more than 15%.

Ed Sheeran accused of plagiarism by Aussie songwriters
Stream " The Rest Of Our Life " and " When I Found You " below alongside the court documents, and judge for yourself. Carey and Golden claim in their lawsuit that the two songs are musically, lyrically and thematically similar.

Le'Veon Bell Will Consider Sitting, Retiring If Steelers Use Tag
Bell held out at the start of training camp this season because he was unhappy about having to play under the franchise tag. Now, I've done everything but own a Super Bowl ... "But, if not, I'll just handle it however I've got to handle it".

Netflix ramps up excitement for Altered Carbon with new trailer
Enter Miguel Sapochnik, director of Game of Thrones' best ever episode - "Hardhome" - and enter Richard Morgan's Philip K. The series will arrive for Netflix subscribers around the world on February 2; you can find its show page here.

Agreement reached on basis for negotiating new German govt coalition - lawmakers
They spoke of a "fresh start" for Germany, and Mr Schulz said that in Europe "we are determined to deploy Germany's strength". SPD delegates will have their say on the preliminary coalition deal at an extraordinary party conference on January 21st.

Taylor Swift teases new 'End Game' music video
Basically, everyone is lit as hell in this music video-which is on brand for all the turn-up references found in Reputation . Taylor Swift , Future , and Ed Sheeran party across the world in the new video for their Reputation hit, " End Game ".

Musician Seal Calls Oprah Winfrey A 'Part Of The Problem'
There have been reports on CNN and elsewhere in recent days that Winfrey has been considering a presidential run. Sea;l hammered Oprah for turning a blind eye to Harvey Weinstein's antics.

Mexico Will Leave NAFTA Talks if Trump Triggers Withdraw
While she puts the chances of US withdrawal at 50-50, "it's too early to throw in the towel on these negotiations", Cutler said. Canadian officials said this week there's an increased likelihood Trump will follow through on his exit threat.

Second Day of Protests Over Child Rape and Murder
A 16-year-old girl on Thursday was strangled to death after rape at Tasawar Abad in Tehsil Bhalwal of district Sargodha. The clarification stated that the chief justice had only referred to a news item that had gone viral on social media.

British train station evacuated, closed after massive morning fire
Video posted to social media shows smoke billowing from a building in the early hours. Emergency services believe everyone inside the building escaped unharmed.