Hidden backdoor API to root privileges in Apple OS X
With physical access, one has been able to create admin accounts for as long as I can remember.<p>- Start up the Mac whilst holding down ⌘-S. This boots the Mac into Single-User Mode and provides a method of interacting with OS X via the command-line, with full root privileges.<p>- Then check the filesystem to ensure there are no problems:  "/sbin/fsck -fy"<p>- Then mount the filesystem for it to be accessible: "/sbin/mount -uw /"<p>- Now remove this file so OS X will re-run Setup Assistant: "rm /var/db/.AppleSetupDone"<p>Now just restart, and enjoy the cool introduction animation as you create your admin account.