MacOS 2018 begins with a new dangerous and embarrassing problem, after last year anyone could take it administrator rights in just a few seconds without knowing the username and password that protected the Macs. This time we are not talking about the same problem, but about a similar one, which affects the AppStore and the security system for the store.
Specifically, macOS High Sierra 10.13.2 allows the location of the settings menu for the AppStore without knowing the password of the user account used to lock the Mac and protect the information on it. This menu exists in the System Preferences application, and access to the settings, if they are blocked, is done by entering the Mac user name and any word that comes to mind, because any password is "received" for unlocking.
Unlocking the settings menu cannot be done with a wrong username, but the password does not matter, because any kind of word is considered to be the perfect password to gain access to the menu. The problem was solved in beta versions of macOS 10.3.3, so only those who have macOS 10.13.2, or a lower version of High Sierra, are affected, the standard Sierra version not being affected.
"The AppStore Preferences in System Preferences can be unlocked by a local admin with any bogus password. This only appears to be when logged in as a local admin. Tested with a non-admin account and I cannot unlock the prefpane with incorrect credentials.”
To be completely honest, after the scandal regarding the security problems of macOS at the end of last year and that of Intel processors, I can't imagine how Apple left such a problem unsolved. I couldn't say who is making the stupid decisions in Cupertino regarding these updates, but it is 100% clear and certain that security and a good customer experience has NOT been Apple's priority for some time, no matter what Tim Cook says.
