• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

Did my cat just discover a major OSX security bug?

D

DS9VOY

Member
This is a serious post. I am asking people to see if they can duplicate this.

I think my cat may have just discovered a major Snow Leopard security bug.

My cat has a tendancy to get up on my desk and walk around on my key board. So in order to prevent him from messing anything up I logged out of my account on snow leopard, and left the mac sitting at the logon screen.

My mac is configured to prompt for a user name and password at every login.

So my cat was standing on my keyboard while the mac was sitting on the login screen. He was just sitting on random keys for a few minutes.

So I hit ENTER (which would normally clear a bogus password). Guess what it did instead? I got a message saying "Your password is too long" and a prompt to MAKE A NEW PASSWORD letting me create a new one!

I have been able to duplicate this consistently the past 20 minutes.

Can anyone else duplicate this? To duplicate this - Configure your snow leopard install to ask for a password and user name to login. Then log out and you should have the screen with your user name and a blank password field.

HOLD DOWN any key on your keyboard. The letter "A" for example. HOLD IT DOWN FOR 3-5 MINUTES. Then press enter on the keyboard. Instead of the password field clearing its self you get a screen saying your password is too long letting you make a new password for the account!

This means anyone can create a new password and login to a Mac simply by holding down a key for a few minutes.

I am doing this on an Imac Core 2 Duo system with snow leopard. I do not have any other macs to test if this happens on OS 10.5 or earlier.
 
snow leopard here. tried it and it asked me to create a new password. however, i can't log in with the new password. my old password still works though.
 
Originally posted by: Printer Bandit
snow leopard here. tried it and it asked me to create a new password. however, i can't log in with the new password. my old password still works though.
Click to expand...

same here
 
Originally posted by: jamesbond007
Or you could pop in the install disc, reboot, run the password reset utility on any Mac and voila! 😉
Click to expand...

Word! The thing is, something like a password prompt to login is temporary security at best. Like a 'Beware of Dog' sign on your fence, unless you have the trained robo-weiler to back up your claim, then it will only scare off so many people.

If a person have multiple minutes of unfettered access to your system in order to hold down a key, then they have already rebooted it off the install image on their thumb drive, reset the password, and started copying your data.

That is where a VERY strong passphrase protected, encrypted sparse-image comes into play. Even more so than FileVault (which encrypts your entire home folder... frankly, I don't care if my music is encrypted), that method is your best bet. You toss that into your documents folder and put everything you really care about in there, 256bit AES encryption is sufficient to take care of most everybody that is likely to try and take your files.

There is no such thing as perfect security though.
 
Originally posted by: TheStu
Originally posted by: jamesbond007
Or you could pop in the install disc, reboot, run the password reset utility on any Mac and voila! 😉
Click to expand...

Word! The thing is, something like a password prompt to login is temporary security at best. Like a 'Beware of Dog' sign on your fence, unless you have the trained robo-weiler to back up your claim, then it will only scare off so many people.

If a person have multiple minutes of unfettered access to your system in order to hold down a key, then they have already rebooted it off the install image on their thumb drive, reset the password, and started copying your data.

That is where a VERY strong passphrase protected, encrypted sparse-image comes into play. Even more so than FileVault (which encrypts your entire home folder... frankly, I don't care if my music is encrypted), that method is your best bet. You toss that into your documents folder and put everything you really care about in there, 256bit AES encryption is sufficient to take care of most everybody that is likely to try and take your files.

There is no such thing as perfect security though.
Click to expand...

You don't even need an install disk! Just boot into single user mode!
 
You don't even need an install disk. Just use single user mode, depending on the 10.x version, start certain services, and voila. New passwords for any user.
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top