Mac OS X Lion passwords can be changed by hackers

You'd think a lion would be pretty good at guarding stuff, but it seems that's not the case with Apple software. A security flaw has been uncovered in Mac OS X Lion that could allow a hacker to easily change your passwords.

Passwords are stored in files called shadow files, which requires you to type in your user password if you want to see or change anything. But Lion has a loophole that lets any user -- not just the admin -- see all the passwords. They can't see the shadow files directly, but they can change the passwords and get in that way.

Lion neglects to ask for authentication when someone changes a password, so all you have to do is type: "$ dscl localhost -passwd /Search/Users/bob" into Terminal, the Mac command line program, and Lion will roll over for you to tickle its belly and set your own password for Bob's user account. It even works for the computer's admins.

The loophole was spotted by Security blog Defense in Depth, which has also come up with a Python script to find someone else's password. Er, cheers for that.

Should you be worried? Not if you're the only user of your Mac. Miscreants can only take advantage of the bug -- calling it a hack is a bit strong -- if they have local access to the computer and Directory Service access. That means the only people who can mess with your stuff are people who've had accounts set up for them.

This is an issue for shared or public computers, but Apple is likely to be all over this like antelope on the veldt. Until it's fixed, it's a good reminder of basic security: disable automatic log-in, turn on passwords to wake your computer from sleep or screensaver, and turn off guest accounts.

Oh, and never leave your password Lion around.