How to protect yourself from the massive macOS High Sierra security vulnerability

Apple released a detailed set of instructions designed to protect your machine.
 By 
Jack Morse
 on 
Original image replaced with Mashable logo
Original image has been replaced. Credit: Mashable

So your macOS High Sierra-running machine is vulnerable to hackers. Like, really vulnerable.

Thankfully, there's a simple way to protect yourself — so long as you can follow a seven-step process laid out Tuesday by Apple. (Update: Apple has released an official patch.)

News broke Nov. 28 on Twitter that an attacker could gain root-user access to an unlocked computer simply by typing "root" into the "User Name" field, leaving the password field blank, and hitting "enter" while in the "Users & Groups" section of "System Preferences."

To make matters worse, if a computer had screen sharing enabled, this could reportedly be exploited remotely.

Apple is currently scrambling to issue a fix, but in the meantime it published instructions on how to protect your computer.

“We are working on a software update to address this issue," the company said in a statement. "In the meantime, setting a root password prevents unauthorized access to your Mac. To enable the Root User and set a password, please follow the instructions here: https://support.apple.com/en-us/HT204012."

When you click through the link, you find those aforementioned seven steps.

1. Choose Apple menu () > System Preferences, then click Users & Groups (or Accounts).

2. Click [lock icon], then enter an administrator name and password.

3. Click Login Options.

4. Click Join (or Edit).

5. Click Open Directory Utility.

6. Click [lock icon] in the Directory Utility window, then enter an administrator name and password.

7. From the menu bar in Directory Utility:

* Choose Edit > Enable Root User, then enter the password that you want to use for the root user.

* Or choose Edit > Disable Root User.

Easy right? But wait, there's more. "If a Root User is already enabled," the Apple statement continues, "to ensure a blank password is not set, please follow the instructions from the ‘Change the root password’ section.”

Those eight steps are:

1. Choose Apple menu () > System Preferences, then click Users & Groups (or Accounts).

2. Click [lock icon], then enter an administrator name and password.

3. Click Login Options.

4. Click Join (or Edit).

5. Click Open Directory Utility.

6. Click [lock icon] in the Directory Utility window, then enter an administrator name and password.

7. From the menu bar in Directory Utility, choose Edit > Change Root Password…

8. Enter a root password when prompted.

So there you have it. Until Apple releases an official patch, you'll just have to clean up its mess on your own.

UPDATE: Nov. 29, 2017, 11:03 a.m. PST This story has been updated to note that Apple released an official patch.

Mashable Image
Jack Morse

Professionally paranoid. Covering privacy, security, and all things cryptocurrency and blockchain from San Francisco.

Mashable Potato

Recommended For You

Hackers are exploiting a vulnerability in lots of e-commerce sites
Fish-eye lens view of a computer screen with hacking stuff on it

How creators can protect their identity in an age of AI clones
woman with doodles and color streaks on face

Updating your security mindset: Keep your data private and your devices secure
By PCMag
Cyber Security

Bumble failed to protect user data in ShinyHunters hack, class action suit claims
thumb tapping bumble logo on smartphone

More in Tech
How to watch Chelsea vs. Port Vale online for free
Alejandro Garnacho of Chelsea reacts

How to watch 'Wuthering Heights' at home: Margot Robbie and Jacob Elordi's controversial romance now streaming
Margot Robbie and Jacob Elordi embracing in still from "Wuthering Heights"

How to watch New York Islanders vs. Philadelphia Flyers online for free
Matthew Schaefer of the New York Islanders warms up

How to watch Mexico vs. Belgium online for free
Israel Reyes of Mexico reacts

How to watch Brazil vs. Croatia online for free
Vinicius Junior #10 of Brazil leaves

Trending on Mashable
NYT Connections hints today: Clues, answers for April 3, 2026
Connections game on a smartphone

Wordle today: Answer, hints for April 3, 2026
Wordle game on a smartphone

Google launches Gemma 4, a new open-source model: How to try it
Google Gemma


NYT Strands hints, answers for April 3, 2026
A game being played on a smartphone.
The biggest stories of the day delivered to your inbox.
These newsletters may contain advertising, deals, or affiliate links. By clicking Subscribe, you confirm you are 16+ and agree to our Terms of Use and Privacy Policy.
Thanks for signing up. See you at your inbox!