Apple MacOS High Sierra security/root bug

If you’ve updated to MacOS High Sierra (OSX 10.13), this is not good news.  Although Apple released a bug fix, it should really give security conscious users some pause.

There are some good overviews of how to harden MacOS/OSX, but I haven’t seen an updated guide that specifically addresses this latest problem (researchers just haven’t had time to investigate the underlying problems and the full extent of what Apple changed and what is affected.  Despite that gap, reviewing a hardening guide and applying relevant procedures is still a good practice.  Here’s a couple references to get you started.

Additionally, here’s a link to a good description of the root account security bug and a manual procedure which hardens the system against this problem.  Conversations in the SecKC community and other security community confirmed the vulnerability and confirmed this manual config appears to address the problem.

Unfortunately this manual approach probably isn’t for most home/casual consumer users.  It requires using the Terminal and some advanced features most users never interact with.  And it introduces a security configuration which would probably complicate future updates and changes for many people.

Bottom line. Apple really messed up.

So what should you do?  If you’re a security conscious person with system administrator skills, you should spend the time it takes to harden your system (and test that hardening).  If your not a sys admin, update update update.  And keep checking for more updates over the next days and weeks.