Monday, 23 April, 2018

New macOS Security Flaw Allows App Store Preferences Unlocking With Any Password

A Mac Book on a table with the High Sierra operating system running and the slogan Macs running the most recent version of High Sierra have another login issue. But it's not as bad as the last one. CNET
Velma Reese | 12 January, 2018, 18:08

First, an attacker would need to have physical access to the device itself and either have the administrator's password (which would allow them to make changes to the system even if the login requirement worked properly) or gain access while an administrator is already logged in.

There's a newly discovered security hole in the current version of macOS High Sierra that allows anyone with access to your Mac to unlock your App Store System Preferences without your system password.

While those settings leave limited options for malicious activity, a threat actor could set up additional attacks by preventing the machine from automatically downloading and installing necessary updates, including those that patch security flaws. Enter any username and password you want and press Unlock and the App Store system preferences will become unlocked.

Coming soon after a previous "root user" password flaw discovered in December, as well as the Meltdown and Spectre chip flaws, the timing is likely to shake consumer confidence, however. If you're on macOS High Sierra 10.13.2, any password will unlock the preferences. As also reported by MacRumors, 10.13.3 has a planned release for later this month, and the bug doesn't seem present in 10.12.6 or earlier versions.

'These settings are unlocked by default for admin users, entering a bogus password only works if you're logged in as an admin user and the settings in this panel aren't particularly sensitive.

Federal judges declare North Carolina gerrymandering unconstitutional
Last year, federal judges ordered 28 state legislative districts redrawn, ruling those were illegal racial gerrymanders. It was the first time federal judges had ruled that a congressional map was unconstitutional because of gerrymandering.

Back in late November, the company wrote: "We greatly regret this error and we apologize to all Mac users, both for releasing with this vulnerability and for the concern it has caused".

The bug report highlighted that this new discovery signified another embarrassing flaw in password-based issues for Apple.

'Our customers deserve better. Maybe Apple already got aware of the loophole and applied the fix.

The attacker would then need to change settings on the computer to establish a "root" account, which they could later access.

Recommended

Apple downplays processor flaws across all Mac, iOS, and tvOS devices Apple downplays processor flaws across all Mac, iOS, and tvOS devices The other bug, which the researchers named Meltdown , cracks the divide between user applications and an operating system (OS). Apple said it now plans to release fixes for its Safari browser "over the coming days" to help defend against Spectre .

BJP asks Rahul Gandhi to 'stop teaching from foreign soil' BJP asks Rahul Gandhi to 'stop teaching from foreign soil' Prasad also slammed Congress over its dual stand on the triple talaq bill in the Parliament and accused it of spreading hatred. He will also have an interactive session with business leaders of Indian-origin on Tuesday.

Winter storm threatens cruise ship with monstrous waves, winds, and flooding Winter storm threatens cruise ship with monstrous waves, winds, and flooding Some passengers said they felt "traumatized" and that their lives were put in danger. "It was so tilted I was shaking". At long last on Friday the ship made it to NY , however a significant number of the travelers need answers.

H&M Offers Another Apology Following Racist Hoodie Controversy H&M Offers Another Apology Following Racist Hoodie Controversy National Basketball Association star LeBron James , rapper Diddy and other artists have also responded with outrage to the image. Meanwhile musician The Weeknd , who has collaborated and modelled for H&M said he was cutting all ties with the retailer.

Domino's Pizza (DPZ) Price Target Raised to $250.00 at Maxim Group Domino's Pizza (DPZ) Price Target Raised to $250.00 at Maxim Group After $1.27 actual EPS reported by Domino's Pizza, Inc . for the previous quarter, Wall Street now forecasts 55.12% EPS growth. It is negative, as 22 investors sold DIN shares while 34 reduced holdings. 35 funds opened positions while 58 raised stakes.

Donald Trump moves to expel 200000 Salvadorans as their USA visas expire Donald Trump moves to expel 200000 Salvadorans as their USA  visas expire Trump said in September that he was ending Deferred Action for Childhood Arrivals, or DACA, but gave Congress until March to act. She says the immigrants temporary protected status does not expire until September 2019, so there is still time to rethink this.

Facebook trialling Instagram to WhatsApp posts Facebook trialling Instagram to WhatsApp posts You will also be able to see all the hashtags your friends follow just like how you can see which accounts they follow. The Instagram Story which will be posted on Instagram will be posted as a WhatsApp status like the rest of WhatsApp .

Serge Ibaka, James Johnson Ejected From Heat-Raptors Game After Throwing Punches Serge Ibaka, James Johnson Ejected From Heat-Raptors Game After Throwing Punches Before practice in Toronto on Wednesday, Cavaliers coach Tyronn Lue showed his team video of the first quarter against Minnesota. They should also be highly motivated to rebound from the rout against a Raptors team 2.5 games ahead of them in the standings.

Dixie Stampede is changing it name to "Dolly Parton's Stampede" Dixie Stampede is changing it name to That's why our Facebook post about Dolly Parton's Dixie Stampede dropping Dixie from its name brought out so many opinions. World Choice Investments , LLC now operates several dinner show attractions in Pigeon Forge and Branson, Missouri.

Call of Duty: WWII Zombies - The Darkest Shore Trailer Call of Duty: WWII Zombies - The Darkest Shore Trailer In The Darkest Shore , you'll run into new types of zombies which will be faster, smarter, and more aggressive than ever before. Activision has just released a new trailer to whet your appetite and to showcase some of what is to come once this is released.

Young Texas Church Shooting Victim Finally Returns Home after Months in Hospital Young Texas Church Shooting Victim Finally Returns Home after Months in Hospital A gunman opened fire at a Sunday service killing 26 people and injuring 20 more in Sutherland Springs, Texas , on November 5. Ryland's stepmother, Joann Lookingbill Ward, was among the dead as well as her daughters Brooke, 5, and Emily, 7.

Canada Draws Line in Trade Dispute with Trump Canada Draws Line in Trade Dispute with Trump Freeland insisted NAFTA talks are on a separate track from the ongoing dispute with the USA over softwood lumber. On NAFTA, Freeland said she remains optimistic that a deal can be reached.

LeBron James, Stephen Curry lead NBA All-Star voting in second fan returns LeBron James, Stephen Curry lead NBA All-Star voting in second fan returns Stephen Curry passed Golden State Warriors teammate Kevin Durant in overall voting and would be team captain if votes ended today. For the last two frontcourt spots, I chose Anthony Davis who is now second in frontcourt voting and Pual George.

Marriott apologizes after listing Taiwan, Tibet as countries Marriott apologizes after listing Taiwan, Tibet as countries Marriott president and chief executive Arne Sorenson soon issued a lengthy apology letter, which described the like as "careless". It triggered an uproar on Chinese social media as Tibet is an "autonomous region" firmly under Chinese control since the 1950s.

Everton readying £20 million offer for Arsenal attacker Everton readying £20 million offer for Arsenal attacker Tosun told the club's official website: "I can say that I am a very good and risky striker when I am in the penalty box". Asked if the move was motivated by Walcott's global ambitions, Wenger said: "Yeah of course, everyone wants to play".