We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
78,762 News Articles

OS X 10.7 Lion flaw 'allows unauthorised password changes'

Researcher claims flaw allows passwords to be changed without knowledge of the logged in user's password

A security research claims that a flaw in Mac OS X 10.7 Lion could allow passwords to be changed without knowledge of the logged in user's password.

The unnamed researcher, writing on the Defence In Depth blog, said that the redesign of Lion's authentication system had somehow allowed non-root users the ability to view password hash data.

Chester Wisniewski, writing on the company's Naked Security blog, said that the flaw appears to be related to Apple's move towards a local directory service in OS X 10.7 which has permissions set in an insecure manner.

"An attacker who has access to a logged in Mac (locally, over VNC/RDC, SSH, etc) is able to change the currently logged in user's password without knowing the existing password as would normally be required. Historically (in Snow Leopard) you would have needed to enter your existing password first to verify that you in fact are the account holder," he wrote.

"Not only can a logged in user change their password without knowledge of the existing password, but you can read any other users password hash and make attempts at brute forcing it. This is particularly dangerous if you are using Apple's new FileVault 2 disk encryption. If your Mac were left unlocked and someone changed your password you would no longer be able to boot your computer and potentially would lose access to all of your data."

Wisniewski said he was unable to replicate findings from Cnet that the flaw would also allow someone to change other users' passwords.

Hopefully the report will spur Apple to release a fix soon, after the company was criticised for its tardy response to the DigiNotar breach. However, the flaw exists in beta versions on Mac OS X 10.7.2, Wisniewski said.

He recommends using a secure password to prevent brute force attacks against your account using stolen hashes; enabling the screensaver and set it to prompt you for your password; disabling automatic logon and using a 'Hot Corner' or the Keychain lock to lock your screen.


IDG UK Sites

LG G Watch review: Android Wear smartwatch is the best around, so far

IDG UK Sites

How to join Apple's OS X Beta Seed Program: Get OS X Yosemite on your Mac before public release

IDG UK Sites

Why the BBC iPlayer outage was caused by a DDoS attack: Topsy and Tim isn't *that* popular

IDG UK Sites

Lenovo has created its own 'Google Glass'