[Flick Lives]

Using a root privilege exploit means that the victim is running at normal priveleges. The exploit bumps the software up to the root level.

By default, the root user account on OS X is disabled. You would first have to manually enable it and assign a password.

[Woodman]

Another more detailed source I read states that this payload can be delivered by physically plugging into a networ, using a USB drive with the payload or an ssd external. It will install without the user having to interact and does not require the user to be root. It is at the hardware level where no checksums are being used, no virus scan is seeing it, and can’t be wiped without reflashing the component.

This was discovered under Windows and them the researchers decided to try MAC because ether use many community hardware components. 3 or 4 out of 5 worked with Mac as well.

[palmer]

That’s only relevant if you are interested in logging into root normally. A privilege escalation bug does not login, does not need the account to be enabled and does not need a password assigned. As a simple example, I can escalate my privilege on MacOS using sudo with my root account locked out and no password assigned (sudo requires my own password). Let’s say hypothetical malware able to sudo without querying the TTY for my password. That would an example of a privilege escalation exploit.