Objective-See reverses macOS #IAmRoot flaw
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Objective-See's reverse engineering reveals macOS High Sierra's root authentication bypass stemmed from an unchecked return value in opendirectoryd's credential verification.
This Objective-See blog post provides a technical root-cause analysis of the widely publicized macOS High Sierra root authentication bypass (dubbed #IAmRoot), tracked as CVE-2017-13872. The flaw allowed any local or remote (via screen sharing) user to gain root access by attempting to authenticate to the disabled root account with any password, including a blank one, entered twice.
Through debugging and disassembly of opendirectoryd and the PlistFile.bundle module, the author traced the bug to a logic error: when authenticating to a disabled account lacking shadowhash data, the system falls back to checking a legacy crypt password field (which holds a placeholder '*' value for disabled accounts). The verification function od_verify_crypt_password returns a non-zero value regardless of whether the actual password comparison succeeded, and the calling code only checked this return value rather than the separate 'match' output parameter that correctly reflected verification failure. As a result, any attacker-supplied password was accepted, triggering an 'upgrade' routine that set that password as the new credential for the account (e.g., root), effectively activating and granting access to it.
Apple patched the issue for macOS 10.13 and 10.13.1 shortly after the public disclosure, adding a check on the 'match' variable. The author confirmed via binary diffing that this matched their root-cause analysis. However, the initial patch introduced its own problems, breaking file sharing for some users and being silently dropped when upgrading from patched 10.13 to 10.13.1, reintroducing the vulnerability. Apple subsequently shipped additional fixes (build 17C1003) and recommended a reboot after patching.
Mentioned in this report
Detection guidance
macOS Root Account Enabled via dsenableroot
Detects execution of dsenableroot to enable the root account on macOS. CVE-2017-13872 (#IAmRoot) ends with the disabled root account being activated, and attackers can do the same deliberately. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: macOS Root Account Enabled via dsenableroot
description: Detects execution of dsenableroot, which enables the disabled root account
on macOS. The
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1548
- attack.t1078
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith: /dsenableroot
filter_disable:
CommandLine|contains: ' -d'
condition: selection and not filter_disable
falsepositives:
- Administrators deliberately enabling root for troubleshooting or legacy tooling
- MDM or provisioning scripts that enable root during device setup
level: medium
id: 09344b83-d5c3-5286-9542-6a71654c8e71
status: experimental
author: Vorant
references:
- https://objective-see.org/blog/blog_0x24.html
macOS dscl Used to Set or Create Root Account Credentials
Detects dscl being used to change the password of, or create attributes on, the local root user record. This is how a disabled root account is activated or given attacker-controlled credentials. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: macOS dscl Used to Set or Create Root Account Credentials
description: Detects dscl invoked against the /Users/root record with a password-change
or create action. This activates the disabled root account or sets attacker-controlled
credentials, the same end state the
tags:
- attack.privilege-escalation
- attack.t1548
- attack.t1078
logsource:
category: process_creation
product: macos
detection:
selection_img:
Image|endswith: /dscl
selection_target:
CommandLine|contains: /Users/root
selection_action:
CommandLine|contains:
- ' -passwd'
- ' passwd'
- ' -create'
- ' create'
- ' -change'
condition: selection_img and selection_target and selection_action
falsepositives:
- Administrators resetting the root password with dscl during maintenance
- Configuration management scripts managing the root account
level: high
id: 3fbe2806-5ae9-5aed-8df2-436ff34cdfb1
status: experimental
author: Vorant
references:
- https://objective-see.org/blog/blog_0x24.html
macOS Root User Record Modified in Local Directory Node
Detects file writes to the local Open Directory root user plist. The #IAmRoot flaw caused opendirectoryd to write the attacker-supplied password into this record, which activates root. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: macOS Root User Record Modified in Local Directory Node
description: Detects file events on the root user plist in the local Open Directory
node. In CVE-2017-13872 (#IAmRoot) the failed authentication to the disabled root
account triggered an upgrade routine that wrote the supplied password into this
record. Correlate with unexpected logins or su/sudo to root.
tags:
- attack.privilege-escalation
- attack.t1548
- attack.t1078
logsource:
category: file_event
product: macos
detection:
selection:
TargetFilename|endswith: /var/db/dslocal/nodes/Default/users/root.plist
condition: selection
falsepositives:
- Legitimate enabling or disabling of root through Directory Utility or dsenableroot
- Legitimate root password changes by administrators
level: medium
id: 35abac06-1b1f-5cad-9e6c-cf2d875546ac
status: experimental
author: Vorant
references:
- https://objective-see.org/blog/blog_0x24.html
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x24.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs