High Sierra 10.13.0 has a serious ssh flaw (exploited in the wild)?

Question

Level 1

23 points

High Sierra 10.13.0 has a serious ssh flaw (exploited in the wild)?

Anyone else noticed this one...?

Take a 10.13.0 system and put it on a public IP with Remote Login enabled (to a single user with a crazy-strong password), and where past systems have sat fine for years with ssh enabled for a single user with a changing password. Within a few days, random system users (MySQL Admin, MySQL Server, FTP Daemon, FTP Admin, Unprivileged user, sshd privileged separation, etc.) start appearing as "Sharing only" in System Preferences-->Users & Groups, until, eventually, root is enabled. Disable root and it gets re-enabled. Change root password and it gets re-changed to something else. Delete the "Sharing only" users and they (or others) eventually come back (and some should rarely ever exist, like the _www user) and more get added. Clean the Mac with new users/passwords and watch it all happen even faster (it's not brute force, but they now know you're running 10.13.0 and hit you faster, it seems?).

Replace the 10.13.0 system with a 10.12.6 one and you're (relatively/respectively/comparatively) fine.

DO NOT ENABLE Remote Login on 10.13.0 at all, but if you must make sure to setup a firewall (kudos to Murus, which helps with obtuse pf and since the built-in firewall is app-only, no IP restrictions).

NOTE: Yes, not having a firewall is bad form, but this 10.13.0 issue is serious and does not happen with prior OS X releases, and the above effectively simulates what you can expect with BYOD, when a bunch of users start bringing this pwned junk into your network...

I'm not sure exactly how it's being exploited, but I have seen this three times already, so there's something amiss.

macOS High Sierra (10.13), null

Posted on Oct 31, 2017 5:25 AM

Reply

Answer 1

BobHarris

Level 9

53,081 points

Oct 31, 2017 6:02 AM in response to MattKinNJ

Have you reported this to Apple?

BugReporter (Free ADC (Apple Developer Connection)) account needed for BugReporter

<http://bugreporter.apple.com>

Anyone can get a free ADC account at:

<https://developer.apple.com/register/index.action>

Reply

Answer 2

MattKinNJ Author

Level 1

23 points

Oct 31, 2017 8:10 AM in response to BobHarris

Not yet, since I don't have the attack details beyond it being 10.13.0's Remote login and not brute force. I have wiped the heck out of these machines since. They may have been tests, but I only had so much time to honey pot any before I had to get them back online (and once I started doing log streams and more investigation, the honey pot system got quiet - maybe I'm just being paranoid there, but...?), so I wiped them and put Sierra back (or 10.13 w/o ssh enabled), and all good since even without murus. Nothing in the logs I saw was a smoking gun (as root they could easily wipe logs and I also have not had time to connect to a remote syslog). A Patrick Wardle type would be more helpful to BugReporter, to take a closer look at this. It may even already be known (maybe even a fix coming in 10.13.1, along with the overdue KRACK fix), but in the interim, it seems pretty bad. Besides, the last bug I posted about iOS and Apple responded two full versions and phones later, so it was moot. I'm not hopeful that my bug reports would be of much help coming from me.

Right now, I'm looking to see if this is more widespread and anyone can confirm what we've seen...anyone?

Reply

Answer 3

MattKinNJ Author

Level 1

23 points

Nov 1, 2017 7:13 AM in response to MattKinNJ

I am assuming that the US-CERT alert may explain this, if the following blanket statement includes the 10.13.1 of the broader Apple updates list from yesterday:

"A remote attacker could exploit some of these vulnerabilities to take control of an affected system."

https://www.us-cert.gov/ncas/current-activity/2017/10/31/Apple-Releases-Multiple -Security-Updates

More reason to NEVER install a .0 (beta) from any vendor (although the reason to test it in the first place was the DUO-reported EFI failed updating issue Apple only addresses by EFI-checking in 10.13...woe is Apple).

Reply