In plain words
Imagine you have a house with a front door that has a special keyhole for the owner, but someone found out that if you just put any key in and turn it, the door will open anyway. This is similar to what happened with the latest version of macOS, where a security flaw allowed anyone to log in as the root user with no password or any password they chose.
What's broken
The bug is in the way macOS handles login requests for the root account, which is like a super powerful administrator account on the computer. Normally, you need a password to log in as root, but because of this flaw, you could log in with a blank password or any password you wanted. This is a big problem because the root account can do anything on the computer, like installing software, deleting files, and even spying on the user.
How it actually works
Here's how it works: when you try to log in as root on a macOS computer, the system is supposed to ask for a password and check if it's correct. But because of this flaw, the system doesn't properly check the password, so you can just type anything or nothing and it will let you in. This is because the flaw is in the part of the system that checks passwords, called the authentication mechanism¹.
Proof of concept
A proof of concept² exists, which is like a demonstration that shows this flaw really works. It proves that the flaw is real and that an attacker could actually use it to log in as root. Having a public proof of concept makes the flaw more urgent because it shows that the flaw is not just theoretical, but something that can actually be exploited by attackers.
Is it real
It is not clear from the source if this flaw is being actively exploited in the wild. However, Apple has since fixed this issue with an update, so if you keep your macOS up to date, you should be protected.
What to do
To fix this issue, you should update your macOS to the latest version. Apple released a patch that fixes this flaw, so once you update, your computer should be safe from this particular issue.
Terms
- ¹ authentication mechanism
- , The process of verifying the identity of a user, like checking a password to make sure it's correct.