MacRumors

There appears to be a serious bug in macOS High Sierra that enables the root superuser on a Mac with a blank password and no security check.

The bug, discovered by developer Lemi Ergin, lets anyone log into an admin account using the username "root" with no password. This works when attempting to access an administrator's account on an unlocked Mac, and it also provides access at the login screen of a locked Mac.

To replicate, follow these steps from any kind of Mac account, admin or guest:

1. Open System Preferences
2. Choose Users & Groups
3. Click the lock to make changes
4. Type "root" in the username field
5. Move the mouse to the Password field and click there, but leave it blank
6. Click unlock, and it should allow you full access to add a new administrator account.

At the login screen, you can also use the root trick to gain access to a Mac after the feature has been enabled in System Preferences. At the login screen, click "Other," and then enter "root" again with no password.

This allows for admin-level access directly from the locked login screen, with the account able to see everything on the computer.

It appears that this bug is present in the current version of macOS High Sierra, 10.13.1, and the macOS 10.13.2 beta that is in testing at the moment. It's not clear how such a significant bug got past Apple, but it's likely this is something that the company will immediately address.

Until the issue is fixed, you can enable a root account with a password to prevent the bug from working. We have a full how to with a complete rundown on the steps available here.

Update: An Apple spokesperson told MacRumors that a fix is in the works:

"We are working on a software update to address this issue. In the meantime, setting a root password prevents unauthorized access to your Mac. To enable the Root User and set a password, please follow the instructions here: https://support.apple.com/en-us/HT204012. If a Root User is already enabled, to ensure a blank password is not set, please follow the instructions from the 'Change the root password' section."

Update 2: Apple released a security update to address the vulnerability on Wednesday morning. The update can be downloaded on all machines running macOS 10.3.1 using the Software Update mechanism in the Mac App Store. Apple says it will automatically push out the update to all users who have not installed it later in the day.

In a statement provided to MacRumors, Apple said the company's engineers began working on a fix as soon as the problem was discovered. Apple also apologized for the vulnerability and said its development process is being audited to prevent something similar from happening in the future.

Security is a top priority for every Apple product, and regrettably we stumbled with this release of macOS.

When our security engineers became aware of the issue Tuesday afternoon, we immediately began working on an update that closes the security hole. This morning, as of 8 a.m., the update is available for download, and starting later today it will be automatically installed on all systems running the latest version (10.13.1) of macOS High Sierra.

We greatly regret this error and we apologize to all Mac users, both for releasing with this vulnerability and for the concern it has caused. Our customers deserve better. We are auditing our development processes to help prevent this from happening again.

All users should download the new security update immediately.

Apple today seeded the fifth beta of an upcoming iOS 11.2 update to developers, more than a week after releasing the fourth iOS 11.2 beta, a month after releasing the first major iOS 11 update, iOS 11.1, and a week and a half after releasing the iOS 11.1.2 update.

Registered developers can download the new iOS 11.2 beta from Apple's Developer Center or over-the-air once the proper configuration profile has been installed from the Developer Center.

iOS 11.2 introduces Apple Pay Cash, Apple's new peer-to-peer payments service. Apple Pay Cash works through the Messages app and is designed to allow for quick person-to-person money transfers. It's available as a dedicated iMessage app in Messages, with cash transferred through the app.

Cash can be sent from a linked debit or credit card, while received cash is stored in an Apple Pay Cash card in Wallet that can be used for purchases or sent to a bank account.

On the iPhone X, iOS 11.2 adds a small bar underneath the icons located at the upper right side of the device on the Lock screen, which is designed to make the location of the Control Center gesture more clear. On the iPhone X, Control Center is accessed by swiping down from the top of the device.

In Control Center on all devices, there are two new informational pop-ups that are displayed when using the Wi-Fi or Bluetooth toggles. These pop-ups explain that Bluetooth and Wi-Fi are disabled temporarily rather than permanently when accessed from Control Center.

In iOS 11.2, there's support for faster 7.5W wireless charging for the iPhone X, iPhone 8, and iPhone 8 Plus. The faster speeds will be available when using third-party wireless chargers that support 7.5W charging or more.

The update also addresses an animation bug in the Calculator app that caused some numbers and symbols to be ignored when entered in rapid succession. The update removes the animations from the calculator app so calculations can be done quickly with no need to pause between entering numbers to obtain the correct result.

In addition to these bug fixes, iOS 11.2 introduces a new Now Playing option for controlling content on the Apple TV in Control Center, redesigned camera emoji, a new loading animation for Live Photos effects, and new Live wallpapers for the iPhone X, plus it adds a feature that lets developers offer new customers discounted introductory pricing for auto-renewable subscriptions on the App Store.

Update: Apple has also seeded a new version of iOS 11.2 for public beta testers.

Yesterday was Cyber Monday, an annual shopping event in the United States, United Kingdom, and many other countries that's part of the holiday shopping season and offers users notable discounts on a vast array of consumer products. Last night, Adobe released its online shopping data for this year's Cyber Monday, stating that November 27, 2017 is projected to set a new record and become the "largest online sales day in history" with a total of $6.59 billion spent by the day's end.

Compared to 2016, Cyber Monday 2017 saw a 16.8 percent year-over-year increase in sales, and it fared better in revenue compared to last week's big shopping days: Black Friday 2017 brought in $5.03 billion and Thanksgiving Day brought in $2.87 billion. Adobe's statistics leveraged Adobe Sensei and Adobe Analytics to analyze data from one trillion visits to over 4,500 retail sites and 55 million SKUs. Of all these data points, Apple and its products were found at the top of a few lists.

The AirPods were listed as overall top sellers yesterday, while iPads were included in the best-selling electronics category, alongside AirPods again, Google Chromecast, Samsung Tablets, Nintendo Switch, and more. In terms of discounts, Walmart was one of very few retailers with a brief sale on AirPods yesterday, marking the $159.00 earphones down by $15. Numerous retailers had sales on a variety of iPads, including the 9.7-inch iPad and 10.5-inch and 12.9-inch iPad Pro.

Shoppers on mobile helped set a new record with 47.4 percent of visits coming from mobile devices (39.9 percent on smartphones and 7.6 percent on tablets). Revenue earned from users shopping on mobile grew 39.2 percent year-over-year and reached a new all-time high of $1.59 billion. Of all mobile devices used to shop on Cyber Monday this year, iOS was in the lead with an average order value of $123, while Android was at $110.

“Shopping and buying on smartphones is becoming the new norm and can be attributed to continued optimizations in the retail experience on mobile devices and platforms,” said Mickey Mericle, vice president, Marketing and Customer Insights at Adobe.

“Consumers are also becoming more savvy and efficient online shoppers. People increasingly know where to find the best deals and what they want to purchase, which results in less price matching behavior typically done on desktops. Millennials were likely another reason for the dramatic growth in mobile, with 75 percent expecting to shop via their smartphone."

The biggest discounts were for TVs (21.1 percent off of the normal price on average), toys (18.8 percent), and computers (14.7 percent). In total, the 2017 holiday shopping season so far (marked as beginning on November 1) has seen a total of $50 billion in online revenue, jumping up 16.8 percent from 2016. According to Adobe, "this will be the first-ever holiday season to break $100 billion in online sales."

If you were planning to purchase a new Apple TV 4K with 64GB of storage from Apple in time for the holidays, you may have to look elsewhere.

As spotted on Reddit, the 64GB model is currently out of stock at most Apple retail stores, and estimated to ship in 4-5 weeks on Apple's online store around the world. Orders placed today might not be delivered until as late as early January.

The reason for the delay is unknown. Lengthy shipping estimates can sometimes foreshadow a product refresh, but the Apple TV 4K was just released in late September, so it's unlikely a new model is on the horizon.

Notably, the 32GB model is still available for pickup at most Apple retail stores today, and estimated to ship in approximately one week on Apple's online store in the United States and over a dozen other countries we checked.

The latest Apple TV supports both 4K and HDR video playback. The set-top box starts at $179 in the United States.

If you are looking to purchase an Apple TV 4K with 64GB of storage, some resellers such as Best Buy, Costco, MacMall, Sam's Club, Staples, Target, and Walmart may still have stock available online or in stores.

Apple today was granted a patent originally filed in August 2016, describing a method in which users would be able to control a Mac computer -- and potentially other devices -- using a "non-tactile three dimensional (3D) user interface" (via Patently Apple). The patent's inventor credits go in part to Amir Hoffnung and Jonathan Pokrass, two current Apple employees who joined the company from PrimeSense after Apple acquired it November 2013.

Some of PrimeSense's tech, which was originally used in Microsoft's Kinect devices on Xbox platforms, now resides in the front-facing TrueDepth camera of the iPhone X, and the new patent hints at a potential future where this technology expands in function to Macs as well. Instead of recognizing faces, Apple's patent describes a Mac that recognizes a "gesture by a hand," allowing users to interact with the computer without tactile inputs like a keyboard, mouse, or trackpad.

The patent includes a variety of gestures that users would use to control the 3D user interface, including what are called "push," (figure 2) "wave," (figure 3) and "up" (figure 5) interactions, which are all grouped into a category of "focus gestures." According to the patent, some of these could be used to perform basic app interactions, like scrolling through a menu, as well as change the state of the system from locked to unlocked.

Gestures described herein include focus gestures and unlock gestures. A focus gesture enables the user to engage (i.e., take control of) an inactive non-tactile 3D user interface. An unlock gesture enables the user to engage a locked non-tactile 3D user interface, as pressing a specific sequence of keys unlocks a locked cellular phone. In some embodiments, the non-tactile 3D user interface conveys visual feedback to the user performing the focus and the unlock gestures.

Examples of unlock gestures include an "up" gesture (e.g., raising hand 30 a specified distance), a sequence of two sequential wave gestures, and a sequence of two sequential push gestures, as described in detail hereinbelow.

Apple has previously been granted patents related to 3D sensing and gesture controls, but the company has yet to release a product that takes advantage of these features. Some of these previous patents included gesture controls on iPads and iPhones as well as on Magic Keyboards, which would allow users to gain access to virtual buttons and potentially streamline certain elements of the user interface.

Of course, with Face ID already launched on iPhone X, it's predicted that Apple will look into adding the facial recognition software into future iMacs and MacBooks before it focuses on a new unlocking system. It's also unclear whether the new 3D user interface patent would include both pieces of technology -- 3D gestures and Face ID -- to further augment a Mac's unlocking process.

As with any patent, the technology in question might not make it to an Apple product in the near future, if at all, but it is an interesting glimpse into what Apple might be planning to do with PrimeSense's technology down the line.

Apple today announced it has opened registration for free all-ages "Hour of Code" sessions between December 4 and December 10 of this year at all of its nearly 500 retail stores around the world.

Apple also introduced a new Hour of Code challenge in the Swift Playgrounds app for iPad that invites students to build a digital robot, and added new teacher resources to the Everyone Can Code curriculum to help students learn Swift.

Apple's new Everyone Can Code curriculum includes a free Hour of Code guide featuring the new Swift Playgrounds challenge to make it easy to get started teaching code in schools, community centers and after-school programs. Schools can easily host their own one-hour Hour of Code event anytime simply by downloading the Swift Playgrounds app and Hour of Code guide.

Apple has offered Hour of Code sessions for five consecutive years in celebration of Computer Science Education Week.

PDF: Hour of Code with Swift Playgrounds—The Incredible Code Machine Facilitator Guide

Apple has launched an official Apple Support YouTube channel, uploading a series of videos that cover assorted iOS tips and tricks to help out customers new to iPhone and iPad.

First noted on Reddit, the Apple Support YouTube channel was registered on October 5, but had remained dormant until yesterday when the channel was quietly populated with its first 10 short how-to videos, which are between one and two minutes in length.

The videos offer quick-fire iOS tips such as "How to send and save GIFs on your iPhone", "How to change the wallpaper on your iPhone or iPad", and "How to delete call history on your iPhone".

The support channel joins Apple's existing official YouTube channel, and complements the official Apple Support Twitter account, created in March 2016, as well as the Apple Support iOS app, released in November 2016, and the main Apple Support website.

The Apple Support YouTube channel can be found here. And don't forget, you can also subscribe to the official MacRumors YouTube channel here.

Since the iPhone X launched earlier this month, people have been attempting to fool Face ID, the new biometric facial recognition feature built into the device as a primary security feature. Face ID has thus far been tricked by twins, children, and even a mask.

Vietnamese security company Bkav made headlines in mid-November after uploading a video featuring Face ID accessed by a mask, but there were several questions about the unlocking methods used in the video, including whether "Require Attention" was turned on. Today, Bkav shared a second video with a new mask and a clearer look at how the mask was used to spoof Face ID.

As described in an accompanying blog post, Bkav used a 3D printed mask made of stone powder, which cost approximately $200 to produce. 2D infrared images of eyes were then taped over the mask to emulate real eyes.

Bkav reset Face ID on camera and then set it up anew with the demonstrator's face. "Require Attention for Face ID" and "Attention Aware Features" were both shown to be enabled on the iPhone X. For those unaware, "Require Attention for Face ID" is meant to add an extra layer of security by requiring you to look at your iPhone to use Face ID, and it's one of the features that's supposed to prevent Face ID from unlocking with a mask, with a photograph, or when you're looking away from your phone.

After activating Face ID, the Bkav demonstrator unlocks the iPhone X normally with his own face, and then unlocks it once again with the mask. The mask appears to be able to unlock the iPhone X right away, with no failed attempts and no learning, as Face ID was set up from scratch just before the test. The mask's 2D infrared eyes also appear to fool the "Require Attention for Face ID" setting.

Bkav claims the materials and tools used to create the mask are "casual for anyone" and that Face ID is "not secure enough to be used in business transactions," but it's worth noting that fooling Face ID in this way requires a 3D printer, several hundred dollars worth of materials, physical access to a person's iPhone X, and detailed facial photographs that can be used to reconstruct a person's face. Even then, if the 3D printed mask and the design of the infrared eyes aren't perfect, Face ID will fail after five attempts.

Bkav believes Face ID is less secure than Touch ID because it's easier to capture photographs from afar than it is to obtain a fingerprint, but this is still a very complex replication process that the average user does not need to be concerned with.

Bkav researchers said that making 3D model is very simple. A person can be secretly taken photos in just a few seconds when entering a room containing a pre-setup system of cameras located at different angles. Then, the photos will be processed by algorithms to make a 3D object.

It can be said that, until now, Fingerprint is still the most secure biometric technology. Collecting a fingerprint is much harder than taking photos from a distance.

Apple's Face ID security white paper [PDF] outlines several scenarios where Face ID has a higher probability of being fooled, including with twins, siblings that look alike, and children under the age of 13, but masks are of particular interest because Face ID features a neural network that was "trained to spot and resist spoofing" to protect against "attempts to unlock your phone with photos or masks." From Apple:

Face ID matches against depth information, which isn't found in print or 2D digital photographs. It's designed to protect against spoofing by masks or other techniques through the use of sophisticated anti-spoofing neural networks. Face ID is even attention-aware.

When Touch ID, Face ID's predecessor, was first released in the iPhone 5s in 2013, there were many similar demonstrations of how it could be fooled with a fake fingerprint, but there's little evidence that these methods were ever used to unlock devices in the real world on a wide scale basis, and it turned out to be something most iPhone users did not need to worry about. The same is likely true of Face ID.

Apple has made several improvements to Touch ID over the years, making it faster and more accurate, and similar improvements will undoubtedly be made to Face ID in the future. In the meantime, while Face ID can be fooled by a twin or a complicated facial replication process, it's largely secure for most users and has received mostly positive reviews for its security and ease of use.

Apple today uploaded several new iPhone X ads to its YouTube channel, highlighting a range of features like Face ID and Animoji.

Apple's 38-second "Animoji Yourself" spot shows off "Animoji Karaoke," a phenomenon that kicked off shortly after the iPhone X launched. With Animoji Karaoke, the idea is to use Animoji to lip sync to popular songs, making it look like the Animoji are doing the singing.

The Apple Animoji ad features several Animoji characters singing the song "All Night" by Big Boi. Animoji Karaoke videos have been widely shared on Twitter, reddit, and other social networks, though interest in the feature has died down somewhat a few weeks following the iPhone X's launch.

Along with the Animoji ad, there are three new videos focusing on Face ID. The first view is an overview of the Face ID feature, explaining that it unlocks the iPhone X with a look.

The other two ads, which are 15 seconds in length, focus on specific Face ID features, including its ability to work in the dark and adapt to facial feature changes like makeup and glasses.

On its Canadian YouTube channel, Apple has also shared a video that explains how Face ID adapts to changes and works with facial hair growth. It's similar to the "Knows When You Change" video on the company's US YouTube site.

Apple shared several videos of the iPhone X when it was first introduced in September, but these are the first iPhone X specific videos that have been released since then, aside from a tutorial video walking users through the various iPhone X features and how to use them.

Apple will use these ads to show off iPhone X features on television, on the web, and on social networks like Instagram.