UPDATE:

Hours after the story first broke of a major security flaw in macOS High Sierra, Apple has issued an update to fix the problem.

Available now, the update can be downloaded by opening the App Store app, then clicking Updates and installing 'Security Update 2017-001'. Apple says the update "is recommended for all users and improves the security of macOS".

While that is true, the update actually fixes a major security flaw which made it possible for anyone to log into a locked Mac with no need for any password at all. Once logged in, they were given 'root' access, meaning they had administrative privilege and access to the entire system.

GearBrain found the update took between four and five minutes to download and install. We also found that users running the public beta of High Sierra must make sure their operating system is updated before looking for the security fix, as it will not appear in the App Store's Updates page until you are running Public Beta 5 or later.

macOS High Sierra security updateScreenshot

ORIGINAL STORY

Apple is working to fix a major bug which gives full administrator privilege to anyone using a Mac in a matter of seconds and without a password.

The bug is present in Apple computers running the company's newest operating system, macOS High Sierra. Once exploited, the flaw gives anyone the ability to make themselves an administrator account on the machine, which comes with the power to install potentially malicious software, reset passwords, view hidden files and delete existing user accounts.

Discovered by Turkish computer developer Lemi Ergin and revealed on Twitter, the 'hack' is incredibly simple to perform. From the login screen, click 'other' next to the main user's account, then enter 'root' as the username and leave the password field blank. Then press enter. Sometimes several presses of enter are required, but the outcome is the same - you are logged into the Mac's 'root' account, which has full administrator privilege.

If you have the 'other' account option switched off, you are somewhat protected. However, the hack can also be performed while the Mac is left unattended while logged into the main user's account. Head to System Preferences, click Users & Groups and click on the padlock. Then, enter 'root' and leave the password blank. Click Unlock twice to create the root account. Both methods are startlingly simple, and GearBrain verified that both work as described on a 2016 MacBook Pro running macOS High Sierra.

Researchers have found that attackers don't need physical access to exploit the bug. Patrick Wardle reports that in some cases, if Screen Sharing is enabled on the target Mac, a hacker can gain access to the root account.

Computer security expert Graham Cluley said in a blog post about the flaw: "This is pretty bad of Apple...Once someone has root on your Mac, they have God-like powers over the entire system."

Thankfully, there is a temporary solution before Apple issues a fix via a software update. As explained by an Apple Support document, this involves giving that root account a password other than the blank default.

Apple said in a statement: "We are working on a software update to address the issue."

Gryphon AX – Ultra-Fast Mesh WiFi 6 Parental Control Router – Advanced Content Filters and Next-Gen Firewall - 4.3 Gbps Across 3,000 sq. ft. per Router for Multi-Device Households

Gryphon AX – Ultra-Fast Mesh WiFi 6 Parental Control Router – Advanced Content Filters and Next-Gen Firewall - 4.3 Gbps Across 3,000 sq. ft. per Router for Multi-Device Households

List Price: $299.00

New From: $299.00in Stock

Used From: $149.00in Stock