Skip to main content

Apple releases update to fix critical macOS High Sierra security issue

Apple releases update to fix critical macOS High Sierra security issue

/

This is one you should install right away

Share this story

MacBook and MacBook Pro 2017
Photo by Amelia Holowaty Krales / The Verge

Apple has just rolled out a security update for macOS High Sierra that fixes the major flaw that was publicly disclosed yesterday. A support page for the patch, Security Update 2017--001, confirms that it addresses the vulnerability that allowed admin access to a Mac computer without providing any password. The update breaks file sharing for some users, but Apple has released a fix for that as well.

Apple is urging customers to “install this update as soon as possible” right in the update description, and you should probably heed that advice if you’re running the company’s latest desktop software. Seriously. It’s even in bolded text. Apple is doing its part to make sure the crucial security patch spreads fast: beginning later today, the update will automatically be installed on all systems running High Sierra. That should make life easier for IT administrators.

But Apple is clearly disappointed with itself over this whole thing. It’s a humbling embarrassment for a company that so often highlights its focus on user security and privacy. "Security is a top priority for every Apple product, and regrettably we stumbled with this release of macOS,” Apple said in an unusually forward statement. “We greatly regret this error and we apologize to all Mac users, both for releasing with this vulnerability and for the concern it has caused. Our customers deserve better. We are auditing our development processes to help prevent this from happening again.”

To safeguard your Mac, just open the Mac App Store and you should see the update available to download. The installation process doesn’t require a restart — or at least it didn’t when I updated moments ago.

Unfortunately, the hurried update can break authenticating or connecting to file shares on some Macs. According to Apple, you can fix this by launching the Terminal app, entering “sudo /usr/libexec/configureLocalKDC” at the command line, and then entering your administrator password.

The exploit was shared in full detail on Twitter yesterday, prompting Apple to quickly publish step-by-step instructions for protecting against the “root” password loophole. This patch to fully resolve the issue comes less than 24 hours later. And it seems to have been a very quick effort; Apple says its security engineers went work when they became aware of the flaw “Tuesday afternoon,” which confirms that the company got no warning before it was publicly revealed.

Updated November 30th, 1:13 AM ET: Added instructions and link to repair file sharing.

Today’s Storystream

Feed refreshed 14 minutes ago Yes, it happened again.

E
Twitter
Elizabeth Lopatto14 minutes ago
Signal, the encrypted messaging app, gets free promotion from Twitter’s lawyers.

Last year, Elon Musk tweeted “Use Signal,” leading to a spike in new users. Twitter’s lawyers said in a footnote in a previous filing that Musk had been messaging with investor Marc Andreessen of a16z on Signal about a Twitter investment. The problem for Twitter’s discovery process is that Signal messages can be set to auto-delete; Musk’s lawyers maintain he doesn’t ordinarily use Signal for business. Now, there’s a sealed motion that.... contains Musk’s Signal tweet. 👀


A
Alex Cranz37 minutes ago
If you’re into the minimalist PC build than Nvidia’s latest GPUs might present a problem.

Nvidia finally announced the 40-series—specifically the more expensive and more powerful 4090 and 4080. But big power means these are some big cards and that could be a problem for PC builders who prefer smaller, minimalist looks for their PCs. Builders at the /sffpc subreddit, that focuses on small form factor pc builds, are already worried.


B
The Verge
Barbara Krasnoff49 minutes ago
A lot of people seem to agree that lock screen widgets are one of the best new features of iOS 16.

So we put together a how-to on customizing your iPhone’s lock screen and wallpaper with widgets and design options, and even linking them to Focus modes. It’s easier than you’d think.


A
The Verge
Andrew WebsterTwo hours ago
Deathloop is out on Xbox Game Pass today.

If you subscribe to Xbox’s Game Pass service, you should definitely check out Arkane’s Deathloop, which is out now. It was one of my favorite games of last year when it debuted on the PS5 and PC, mixing extremely satisfying action with an intricate story about time loops. Here’s the full list of the latest Game Pass releases.


D
External Link
David PierceTwo hours ago
Bluetooth speakerphones are an underrated accessory.

Wirecutter has a good roundup of options, which are as good for Zoom calls as advertised, but they’re also just useful in life! I use mine roughly as a desk phone, and also connect it every time we’re doing the “everyone gather around the phone to talk to Grandma” thing. I have the Jabra Speak 510, and love it.


E
External Link
Elizabeth LopattoTwo hours ago
The SPAC-lash is here.

So remember the craze for SPACs, an alternative way to take a company public? The times, they have a-changed: the SPAC King of Silicon Valley, Chamath Palihapitiya, couldn’t find acquisition targets for two of his piles of cash. One of them, Social Capital Hedosophia VI, is the largest-ever SPAC.


R
Twitter
Richard LawlerTwo hours ago
Use every (mega) pixel.

Halide is touted as one of the best photography apps on the iPhone, and as usual, it has a new update out to help you get the most out of the best camera available on the platform — that 48-megapixel sensor on the iPhone 14 Pro.

Version 2.9.0 of Halide is live in the App Store, with quick 48MP shooting directly to HEIC or JPG and many other new features.


N
Quote
Nilay PatelTwo hours ago
Speaking of CarPlay.

Dan posted about CarPlay earlier and it reminded me that wireless CarPlay has actually set Apple back in its quest to somehow take over the car market — problems with it disconnecting are the number one complaint from new car owners, according to JD Power. Something to think about as Apple continues its relentless quest to remove all the ports from our phones.

The most frequent problem reported across the industry regardless of powertrain type or brand cachet related to smartphone connectivity. Dropped connections with Apple CarPlay was the number one problem, as Android Auto complaints leveled off from last year. Further, the number of reported problems with wireless Apple CarPlay increased as well, due to the feature being offered in more cars. 


R
Twitter
Richard Lawler2:43 PM UTC
PC gamers showed up for a PlayStation hit.

NPD’s August update for videogame sales has arrived, noting that PS5 was number one in hardware sales for the month and that new-gen hardware sales are up significantly from last year due to improved supply for both the PS5 and Xbox Series X / S.

But the most astounding leap came from Marvel’s Spider-Man, which jumped from 84th on the chart the month before to number 3, thanks to Sony re-releasing the PlayStation exclusive on PC via Steam (and Steam Deck).


D
External Link
Dan Seifert2:37 PM UTC
Apple’s CarPlay is still frustratingly basic.

Stephen Hackett at 512 Pixels has blogged about the frustrations he’s had migrating to a new iPhone and not having his CarPlay preferences carry over, despite every other app on his phone copying over correctly.

I’m with him on that, but I’m more annoyed by the second point he highlights: CarPlay still treats every vehicle you connect to as a different thing. Instead of preserving your preferences when you plug in to a different car, it makes you set it all up again for each new vehicle. This is annoying for families with more than one car; it’s downright maddening for frequent users of rental cars. Seems like a simple thing to fix!