11 ms·
MacOS FileVault2 Password Retrieval
- suprfsat 10y agoHow is Google's own blogging platform still embedding flash videos?
- nicolas_t 10y agoHas Apple released patches for El Capitan? I'm still using it instead of Sierra because of Karabiner but this could force me to upgrade. That vulnerability seems to be a pretty obvious oversight. I remember hearing about DMA (in the context of Firewire) as an attack vector since people first started talking of Truecrypt and Filevault and scrubbing the memory seems obvious... It's worrying that this could have been overlooked by Apple's engineers.
- miguelrochefort 10y agoYou better update quick! /s Chances that someone use that device to hack your computer: 0
- deleted 10y ago[deleted]
- wlesieutre 10y agoIs Karabiner Elements missing features you need? https://github.com/tekezo/Karabiner-Elements https://github.com/tekezo/Karabiner-Elements I haven't tried it because I can't find the wireless mouse that I needed Karabiner for, but my impression was it has most of the functionality running, especially the key/button remapping which seems to be their biggest use case.
- nicolas_t 10y agoI haven't found a way to configure Karabiner Elements to replace Caps lock with Escape when I only press that key (for vim) and with Ctrl when I press it in combination with other keys (for the terminal). I also have both Shift keys bound to () when pressed alone and Shift when pressed in combination with other keys.
- wlesieutre 10y agoDiscussion of the caps lock solo/chorded feature here: https://github.com/tekezo/Karabiner-Elements/pull/170#issuecomment-257091685 https://github.com/tekezo/Karabiner-Elements/pull/170#issuec... Looks like it's not in master, but somebody has builds that do it.
- nicolas_t 10y agoThanks wlesieutre! I had looked in the issues but somehow missed that pull request. Now I can use Sierra :)
- wlesieutre 10y agoHappy to help!
- mnadkvlb 10y agoThanks for the use-case, i am really fascinated to use this from now on. Working with vim would be awesome.
- mweibel 10y agoIf that's the update: https://support.apple.com/en-us/HT207423 https://support.apple.com/en-us/HT207423 then yes.
- mapgrep 10y agoThat changelog includes a bunch of fixes that are Sierra only, so the answer may be "no" contrary to your comment. This is the closest I can find on there to this issue and the fix is Sierra only: IOFireWireFamily Available for: macOS Sierra 10.12.1 Impact: A local attacker may be able to read kernel memory Description: A memory corruption issue was addressed through improved memory handling. CVE-2016-7608: Brandon Azad Attribution on that doesn;t look right; TFA was by "Ulf Frisk" who was nowhere on that page. Why would someone be using El Capitan still, some may ask. Well there is software not updated for Sierra yet. For example, GPG for Mac is not yet ported over.
- nicholasserra 10y agoDoesn't seem like the patch is for El Capitan, as all the kernel fixes only list Sierra.
- pier25 10y agoApparently this fix is only available for Sierra 10.12.2 A nice big finger from Apple to those of us that won't upgrade.
- M4v3R 10y agoTo be fair, it seems that all OS vendors overlooked this: https://www.youtube.com/watch?v=fXthwl6ShOg https://www.youtube.com/watch?v=fXthwl6ShOg
- tptacek 10y agoThings like this are a reason I unhesitatingly recommend that people stick with their OS's built in FDE: 1. FDE is extremely limited. This particular attack is a clever abuse of sleep/reboot cycles, but of course people intimately familiar with FDE know that if a laptop is sleeping but not shut down it's already perilously close to the boundary at which FDE breaks down. And, of course, once it's woken up and unlocked --- which every attacker who actually challenges FDE can arrange for, all bets are off. 2. When flaws like this are found, the OS vendors have much more recourse than third parties do, which is why this post concludes by saying that Macs are now the most secure laptop platform with respect to DMA attacks against FDE. Use FDE! Enable it on all your machines! But try not to rely on it, and don't waste too much time optimizing it.
- nicolas_t 10y ago> And, of course, once it's woken up and unlocked --- which every attacker who actually challenges FDE can arrange for, all bets are off. I'm not sure what you mean by that? Do you mean that the attacker can force you to wake up and unlock the computer? In that case FDE is not moot anyway, no? For me, the reason I use FDE is in the case I lose or forget my computer somewhere, I do not want the legal liabilities with a thief accessing my customer's source code.
- teddyh 10y agoEven though the computer may be “locked”, if the OS is running and accessing the disk, it means that the key is present somewhere in memory. There are various methods of accessing this key, the fallback brute-force method being the (https://en.wikipedia.org/wiki/Cold_boot_attack https://en.wikipedia.org/wiki/Cold_boot_attack). The method from the article only removes the need to physically remove and cool the memory chips.
- gommm 10y agoOk, I thought that Apple would scrub all keys from memory when the computer goes to sleep so that a computer that's asleep would not be vulnerable to the Cold Boot Attack. Seems strange they don't do that? Or would it make waking up too slow?
- mkj 10y agoDid a firmware password prevent it? The same problem with FireWire was prevented by that (a decade ago)
- partiallogic 10y agoWould really want to know this as not everyone wants to upgrade their OSX
- jonknee 10y ago> Would really want to know this as not everyone wants to upgrade their OSX Anyone who wants to stay secure should want to upgrade their system...
- kalleboo 10y agoWhile I'm not excusing this bug (didn't they already go through this round of DMA bugs with FireWire?), this reinforces my belief that once you have physical access to a personal computer - all bets are off. If you lost your laptop, rotate all keys. Change all passwords. Assume everything is compromised.
- eeeeeeeeeeeee 10y agoThere is a huge difference between physical access and the computer being on. That is the first thing this exploit says -- it doesn't work if the computer was turned off previously. This has always been the way to protect a computer that uses full disk encryption. Turn it off. Sleep mode will not protect you.
- eeeeeeeeeeeee 10y agoAlthough this is an exploit and should be fixed, FDE rarely works if your computer is on / sleeping. Same thing with the iPhone. Even though it has solid FDE, there have been exploits if the phone is on (even with a passcode, etc). Turning off your device is the best protection, even if you have FDE.
- falcolas 10y agoWell, I'd say "Turning off your device is the only protection when you have FDE", since shutting off your computer will do nothing to protect it if you don't have FDE enabled. If it's not encrypted, connecting another computer to it with an appropriate cable will let you use it as a remote disk, leaving no real traces that it was touched.
- eeeeeeeeeeeee 10y agoUhh, I think that was pretty clear from my comment. FDE only gives you "complete" security in transit if you shut it off. Leaving a FDE computer in sleep mode will not protect you. But even in sleep mode, a FDE computer is still better than no encryption at all.
- renaudg 10y agoWhat do you mean ? This was a bug, but FV2 is clearly designed as FDE that works even if the computer is sleeping.
- therealmarv 10y agoIs this the main reason why the Kernel Version number increased with macOS 10.12.2 ?
- appledude 10y agoThe kernel version was incremented due to kernel fixes (https://support.apple.com/en-us/HT207423 https://support.apple.com/en-us/HT207423). The Filevault vulnerability was fixed in 10.12.2 with a firmware update, part of the incremental update.
- ysleepy 10y agoI'm interested in how this was fixed. Is the update an EFI update which disables DMA or does it with IOMMU? Or is the memory just overwritten on boot? I'm also quite surprised they leave the password in memory in multiple locations. - Assuming the password is only used to derive the KEK for the actual key.
- dom0 10y agoThis interests me, too. I can only assume, since disabling DMA would imply a huge performance hit (and quite likely many broken devices?), that the update enables the IOMMU right from the system start, probably directly in the firmware, and has nothing/only a whitelist mapped, with further mappings only explicitly enabled by drivers?
- astrodust 10y agoI wonder if the chipset can't do a sort of DMA emulation, or DMA with conditions versus the sort of free-for-all stuff you'd see with things like FireWire.
- dom0 10y agoThat's what an IOMMU does. Without an IOMMU devices on extension buses directly address physical memory. With an MMU the host CPU creates a virtual address space for devices and can thus limit access to the main memory (conveniently also allows passing devices to VM guests), much like virtual memory for processes/VMs.
- deleted 10y ago[deleted]
- feld 10y agoThis exact command: sudo firmwarepasswd -setpasswd -setmode command enter in a password to lock down Option ROM, reboot. Now you're protected. source, the hacker-now-Apple-developer: https://twitter.com/XenoKovah/status/809418554428657666 https://twitter.com/XenoKovah/status/809418554428657666
- djvdorp 10y agoDupe of https://news.ycombinator.com/item?id=13187655 https://news.ycombinator.com/item?id=13187655 ?
- kevinburke 10y agoIs a 10.11 machine encrypted with FileVault vulnerable to this attack?
- appledude 10y agoYes, even if you install the December 2016 security update for 10.11.6; only 10.12.2 is protected against this Filevault vuln.
- thijsvandien 10y agoAre you planning to backport the fix? It would be very disappointing if a serious security problem like this would be left unaddressed. Not all of us can or want to switch to the latest major within months after its release.
- KirinDave 10y agoGood hack, good on Apple for getting fixes out. But what worries me somewhat is that the tools for mitigation for these families of attacks include a lot of technologies that are traditionally opposed by the community here on the grounds that it "takes away control from the user. I'm not sure how we balance out those tensions, but attacks like this sure as heck concern me about my homebuilt machine. I do my best not to keep any important keys there.
- artursapek 10y agoYou have a homebuilt mac? Like a hackintosh? If so, I'm pretty sure Apple doesn't owe you any kind of security assurances.
- djrogers 10y agoDMA attacks are potentially possible on more than just macs
- kennell 10y agoWhat encryption are you using? I was under the impression that FV2 (or any other full disk encryption solution) does not work on a Hackintosh
- renaudg 10y agoIt unfortunately doesn't work on the boot volume of a Hackintosh, but pretty sure it does on other volumes.
- RainCloud 10y agoActually, there have been recent development on this.[1] I'm not brave enough to try it though. [1] http://www.insanelymac.com/forum/topic/317290-filevault-2/ http://www.insanelymac.com/forum/topic/317290-filevault-2/
- 10y ago
- dashesyan 10y agoI've had this in my .profile for years: alias sleepsafe='sudo pmset -a destroyfvkeyonstandby 1 hibernatemode 25' alias sleepfast='sudo pmset -a hibernatemode 0' alias sleepdefault='sudo pmset -a hibernatemode 3' Whenever I travel or need to leave my laptop, I always run `sleepsafe`, which will delete the key from memory and hibernate the computer when I close the lid. It has the added benefit of saving battery life. Day-to-day, I use `sleepfast`, which is faster than the default hybrid sleep, because it doesn't spend time copying the contents of memory to disk. I very rarely switch to `sleepdefault` which is the insecure and slower hybrid sleep. This has been a known issue for years http://osxdaily.com/2013/07/06/maximize-filevault-security-destroy-key-storage-standby/ http://osxdaily.com/2013/07/06/maximize-filevault-security-d... https://nakedsecurity.sophos.com/2012/02/02/filevault-encryption-broken/ https://nakedsecurity.sophos.com/2012/02/02/filevault-encryp...
- j_s 10y agoThanks for sharing these awesome shortcuts! Are there any caveats that I should be aware of before just stealing this to use for myself?
- lstamour 10y agoYou could read through http://training.apple.com/pdf/WP_FileVault2.pdf http://training.apple.com/pdf/WP_FileVault2.pdf for some of the details, or `man pmset`. Use `pmset -g` at any time to see your current settings.
- dashesyan 10y agoJust make sure you eject any removable disks before hibernating. And, sleepfast may drain your battery faster than the default hybrid sleep
- shshhdhs 10y agoOP said sleepfast increases his battery life. It sounds like you lose whatever is in memory though
- 10y ago
- hf 10y agoFDE: Full Disk Encryption.
- kdeldycke 10y agoI compiled all security enhancing configuration I found for macOS at: https://github.com/mathiasbynens/dotfiles/pull/686 https://github.com/mathiasbynens/dotfiles/pull/686 Not sure these are mitigating the OP issue though. Still, can't be bad to harden macOS a little bit.
- emptybits 10y agoGood on Apple for "completely" fixing this, according to the authors. But am I wrong to wish for more plain-English acknowledgement of the problem and reassurance in Apple's 10.12.2 release notes? i.e. https://support.apple.com/en-ca/HT207423 https://support.apple.com/en-ca/HT207423 Anyways, at this point in time it's nice to read (from the authors of the exploit): "The mac is now one of the most secure platforms with regards to this specific attack vector."
- jakobegger 10y agoI read through the release notes, and I didn't see any mention of this issue at all. The fix must have been a EFI firmware update (my Mac did restart multiple times during the update, so this sounds plausible), but nothing is mentioned about this anywhere.
- gdavisson 10y agoI saw the firmware-update progress bar (one of several similar progress bars that macOS/OS X can show during startup) during a 10.12.2 update. So that's a bit more confirmation...