There's a bug in Apple's most recent operating system

Major Apple security flaw grants admin access on macOS High Sierra without password

If you do that, High Sierra promptly sets up a new account called System Administrator and a home folder located in /private/var/root. Some users have reported triggering the exploit from the login screen, but we could only consistently recreate the issue from System Preferences.

Apple confirmed that it was already working on a solution. The attacker needs only to head to Users & Groups, click the lock at bottom-left, then try to log in as "root" with no password.

That's the bad news. "It allows everyone with access to your machine - and in some cases remotely - to escalate the privileges to the highest level of them all".

Tests of the flaw indicate that it could be used to alter a user's system settings that normally require a chosen username and password.

The simple exploit means anybody with physical access to your MacOS High Sierra device can log in on your computer, no matter how secure your passwords are. They could reset or change passwords, delete or add users and Apple IDs linked to the machine, and dip into other accounts on the system - essentially, they would get unfettered access to all the data that lives on the computer.

It appears the flaw is isolated to High Sierra 10.13.1 (17B48).

Apple hasn't commented yet, but in the meantime, don't let anyone physically use your Mac computer if you're not there until Apple issues a fix.

Published to Twitter on Tuesday by software engineer Lemi Orhan Ergin, the vulnerability is alarmingly straightforward.

This is a serious flaw and you should act quickly to defend yourself.

Click the lock button, then enter your username and password when prompted.

Click in the Directory Utility window, then enter an administrator name and password. This blocks the bug from creating another root account.

Related news:

Hot News

isis-killer-beheading-video-story-top White House all set for Christmas celebrations
Nov 29, 2017 - 01:09
As you can see, the White House now looks like the setting of a horror movie - and people on Twitter are having a field day. No? Well, apparently that's exactly what a certain person in the White House envisions. "She said, "It's not my thing.

isis-killer-beheading-video-story-top Russian fighter executes 'unsafe intercept' of US Navy plane over Black Sea
Nov 29, 2017 - 01:05
The maneuver left "violent turbulence" in its wake, forcing the P-8A to deal with a 15-degree roll, according to Baldanza. Russian military confirmed Tuesday that its warplane drove away a U.S.

isis-killer-beheading-video-story-top HTC rolling out Android 8.0 Oreo for unlocked U11 today
Nov 28, 2017 - 01:22
The smartphone was shipped with Android 7.1 in the U.S. market, which left users anticipating the update for Android 8.0 Oreo. Nonetheless, all users can expect all the major features coming to HTC U11 as a part of Android 8.0 Oreo update.

isis-killer-beheading-video-story-top Alex Iwobi relieved with Arsenal's tough win over Burnley
Nov 28, 2017 - 01:21
The Nigeria global is expected to feature for Arsenal when they host Huddersfield Town at the Emirates Stadium on Wednesday. That's what we did, ' said Wenger, whose side host Huddersfield on Wednesday.

isis-killer-beheading-video-story-top South African pageant crowned the world's most lovely woman
Nov 28, 2017 - 01:14
Nels-Peters was considered a frontrunner for the title after also being crowned Miss South Africa 2017 earlier this year. The last time a South African beauty won the title was 39 years ago when Margaret Gardiner won the title in 1978.

isis-killer-beheading-video-story-top Putin Bites Back After US Interference with Russian Backed Television Channel
Nov 28, 2017 - 01:11
The bill is based on the 2012 law that forced NGOs to adopt a "foreign agent" label if they receive funding from overseas . It's yet not clear if Russian Federation will target traditional USA news organizations as well.

isis-killer-beheading-video-story-top 1 defends Hong Kong Open badminton title
Nov 27, 2017 - 01:53
After the Hong Kong tournament, all the top players will have a couple of weeks' break before heading to the season-ending Dubai World Series Finals.

isis-killer-beheading-video-story-top Jurgen Klopp Explains Row With Sadio Mane At Full Time
Nov 27, 2017 - 01:50
Manchester City are eight points clear of second placed Manchester United and many pundits are already giving the title to Pep Guardiola's men.

isis-killer-beheading-video-story-top Derrick Rose steps away from Cavs, evaluating future in National Basketball Association
Nov 27, 2017 - 01:46
He signed a one-year, $2.1 million contract to join the Cavs in July, and was originally injured on October 20. The 6-foot-3 guard is averaging 14 points and 2 rebounds per game in his first season in Cleveland.

isis-killer-beheading-video-story-top Trump chooses legislative agenda over GOP repulsion of Moore
Nov 27, 2017 - 01:45
He also pointed out that Moore "totally denies" the accusations against him and that the media "has to listen to him also". A White House official clarified to The Times that Trump believes Moore should exit the race if the allegations are true.

isis-killer-beheading-video-story-top Wild Melee Breaks Out Between Raiders and Broncos
Nov 27, 2017 - 01:33
A year ago the two players got into a heated confrontation, causing Talib to snatch Crabtree's chain off his neck during a game . Crabtree and Talib previously had issues with each other, dating back to their skirmish during Week 17 of the 2016 season.

isis-killer-beheading-video-story-top Tom Baker Returns to 'Doctor Who' in Live-Action 'Shada' Scene
Nov 27, 2017 - 01:24
Baker , 83, will appear in " Shada ", an episode that was left unfinished 38 years ago. The episode is now available digitally and will be available on DVD in January.

isis-killer-beheading-video-story-top Oakland County Sheriff's Deputy Struck, Killed By Fleeing Suspect
Nov 26, 2017 - 01:48
According to court records from Macomb County, Berak has prior convictions for possession of marijuana and resisting officers. McKenna said the 22-year-old Macomb County man drove away and was followed by Lapeer deputies into Oakland County.

isis-killer-beheading-video-story-top Black Friday 2017 Best Video Games Deals
Nov 26, 2017 - 01:45
You can get Black Friday bargains across the board today and through the weekend, especially if you're a United States gamer. Unfortunately, Nintendo doesn't have as much Black Friday deals as Xbox, PlayStation, and PC but it has a fair amount.

isis-killer-beheading-video-story-top Kliff Kingsbury Will Be Back In 2018
Nov 26, 2017 - 01:37
Last year, the Red Raiders went 5-7, fueling speculation that Kingsbury was coming into the 2017 campaign on the hot seat. Parker said the Raiders had been playing zone, but changed to man coverage to trick Ehlinger into a bad read.