7 ms·
APFS encrypted plaintext password found in another log file
- radicaldreamer 9y agoThere are so many security holes in the latest MacOS release, I’m wondering if it’s currently the least secure desktop OS. Vulnerabilities are one thing but these issues are simple enough for non-technical end users to exploit on anyone’s computers.
- Spooky23 9y agoIt also makes you wonder how much crap like this is hiding in the complexity of accessing things in iOS. Security is usually more process than anything else. It seems weird that two OS divisions would really be that different.
- chatmasta 9y ago> It seems weird that two OS divisions would really be that different. It’s not weird. The lack of a first class sandbox model on desktop certainly makes its security properties and threat model “different” than those of the iPhone. Yes both are built around XNU and both use APFS, but the “surface area” of attacks is far different across the platforms. For all we know, APFS bugs like these exist in iOS but haven’t been found because finding them would require rooting the phone to circumvent the sandbox model.
- gregoriol 9y agoNot sure about least secure, but clearly least production ready: High Sierra is like a public beta of the version to come.
- beamatronic 9y agoMy IT department told me yesterday to avoid High Sierra at all costs! Is this the norm?
- et-al 9y agoYes, avoid it unless you need to work on the latest Xcode.
- gregoriol 9y agoExactly what just happened to me: I was planning to stay on 10.12 for some more time, but now I need to do some testing on the new iPad 6, which is provided with iOS 11.3 in the box, which is only supported by the new xcode 9.3, which only works on macOS 10.13... #damnit
- 1123581321 9y agoBlindly updating a work machine to a brand-new release isn’t a good idea regardless of the OS. In High Sierra’s case, it took until the .2 release before we were fine with it. Keep in mind that IT departments (including myself here) like to have important things to say about software updates, especially when it’s about the OS that requires a lot less IT work. :)
- radicaldreamer 9y agoExactly, iOS and Mac developers excepted, very little productivity gain comes from updating to the latest version of the OS right away before all the compatibility kinks have been worked out. A lot of people have a (completely understandable) weakness for the latest and greatest though.
- gregoriol 9y agoWhat saddens me the most is that there are a lot of "small" issues that are found now (and by small I don't mean that they are not critical or important, just that they are a small feature/% of the whole), and we forget that Apple teams managed to upgrade the whole filesystem to APFS on this version of macOS, which is a huge feat. We haven't heard that many problems with the filesystem itself or with the upgrade, which is truly impressive at that scale and complexity.
- helthanatos 9y agoApple doesn't have a dedicated MacOS development team anymore and laptops are normally harder to steal/gain access than phones. They have had quite a few security vulnerabilities in the past few months that anyone with physical access could exploit.
- post_break 9y agoThis is just embarrassing. It's not like Apple is spread so thin because of poor sales or a corporate shake up. There's really no excuse for all of these core bugs.
- api 9y agoThe iPhone was so successful it ate the company. Everything else is an afterthought to "sell more phones." Security takes a back seat to animojis and better cameras. The mobile market has plateaued, so this will harm the company long term. Success defines and then limits you.
- amelius 9y ago> The iPhone was so successful it ate the company. And with all the vertical integration going on, it may eat the world.
- matt_wulfeck 9y ago> Security takes a back seat to animojis and better cameras. I somewhat agree with you, but iPhone security is first-in-class.
- dunham 9y agoiPhone security is great, but they had a really embarrassing issue in the backups around iOS 10 - where they were sha hashing the backup password and storing the result in the backup. (This was in addition to the password handling which was a properly designed PBKDF2, etc). I don’t think their security skills are very evenly distributed. Perhaps they are growing the dev team too quickly and the experienced devs are spread too thin.
- saagarjha 9y agoiOS is probably a larger target, so it's pretty clear that the obvious choice is to put most of your security talent there. That being said, core OS fixes propagate to both systems due to their shared codebase.
- crankylinuxuser 9y agoSo, is the iPhone full of these as well? Has anyone did a public audit of the leaked secure enclave firmware? I know there's that company who sells the black haxx0r boxes for $15k or $30k. Long question short: do we have a secure cell we can buy/make?
- Bud 9y agoOne that is worth using? No.
- a_t48 9y agoI thought the deal was that they would let you use the box once for 30k, not give the box to you.
- saagarjha 9y agoThere was an on-site version as well that sold for significantly more.
- danieldk 9y agoSo, is the iPhone full of these as well? It's hard to tell, but with the application sandboxing in iOS, it is unlikely that any regular app could access log files. AFAIK, on macOS, sandboxed applications cannot access logs either. But applications are moving out of the app store, because Apple hasn't really accomodated Mac developers.
- jlgaddis 9y ago> Long question short: do we have a secure cell we can buy/make? Nope, and there won't be until there's an (open-source?) baseband that can be audited either.
- fwgwgwgch 9y agoI was planning to ditch my android for iPhone but reports like this make me worried. Can we have a reasonable discussion without fanboy ism about what is the most secure phone right now? (reply only if you have a security background)
- BuildTheRobots 9y agoI think it's impossible to talk about "most secure" with out being more clear who you're trying to protect against. Rogue apps, hackers, law enforcement and state actors are 4 different attack vectors that jump to mind that all have different mitigations. We'd also have to talk about how usable you expect the phone to be afterwards; for example if to make it secure we have to disable wifi, mobile-data and apps, is there any point in having a smart phone in the first place?
- jlgaddis 9y agoI, personally, am much more comfortable using an iPhone than any other mobile phone. I have very little trust in Android phones, especially one that has > 0 apps from the Play store installed. (I'd still be using a Blackberry if they had any decent offerings, however.)
- konceptz 9y agoBefore we just jump on Apple we should probably see if we can recreate the issue. The article stated that another user could not replicate this issue and the original researcher was also unable to replicate after a possible stealth update.
- darklajid 9y agoNo, the article says that another user and the author weren't able to reproduce the original issue. Digging into the install.log the author found the same sh....stuff.
- hannibalhorn 9y agoI can confirm I found my password in my install.log. I just zero'd it out, but definitely not an ideal situation...
- zf00002 9y agoOn 10.13.4, my install.log does not have my password that I can find.
- hannibalhorn 9y agoI already ran shred on the log to erase all traces, so I can't be more specific, but I know I did a fresh install (not an upgrade) of the whatever the latest High Sierra was at the time in mid-November...
- danieldk 9y agoJust checked in my install.log, the password is indeed there.
- mjhoy 9y agoCan't find on mine, just upgraded to 10.13.4 from Sierra.
- nothrabannosir 9y agoCan confirm, just checked: it's there. Since 30 Nov '11, when I did a fresh reinstall with apfs encrypted drive. Wow.
- oneplane 9y agoThis is rather crappy QA or the lack of verification of the QA process at Apple. I really hope they pick up the slack they have been forming over the past ~5 years, it's starting to get predictably bad.
- asveikau 9y agoCould also be bad hiring. Mistakes do happen, sure, but the only instances in which I personally noticed a dev accidentally slipping personal data into a log file, they tended to have other issues in their work like an unusually high bug count.
- sebazzz 9y agoBad hiring, or bad management. There is a well-known "triangle" of [money, quality, time]. You can fix two factors at most, but that means a third factor will suffer. This decision is made by the management, whether or not they realise this triangle exists.
- woolvalley 9y agoThey don't pay as well as facebook and google on initial offers. So if you have a choice... Most people aren't willing to sacrifice to apple either, since they have a lot of money in the bank.
- tzs 9y agoLanguage can be a contributing factor. In a language that includes a generic dump routine that can convert an arbitrary data structure into a useful string representation, or that makes it easy to write such a routine if one is not built in, people tend to use that facility to convert things for logging. Then later someone adds a sensitive field to some data structure, and if anything is logging that structure it will pick up the new field. In a language like C, where I don't think you can write a nice dump_arbitrary(void * data) function, and so if someone wants to log something they have to write a routine specifically to deal with that particular thing, when someone adds a sensitive field to a struct it does not automatically go into logs. It only goes in if someone specifically updates the logging code to know about the new field.
- doorbackfbi 9y agoFBI BACKDOOR
- llao 9y agoSo, did no one grep -R --as-text "my password" / before?
- saagarjha 9y ago~/.bash_history:42: grep -R --as-text "my password" /
- rlkf 9y agoIf the environment variable HISTCONTROL contains the keyword ignorespace, then commands starting with a space won't be saved in the history list; usable in situations like this. (Of course, the command will be visible in the process list, so if you are on a shared system, it is still not a good idea)
- justincormack 9y agoThere are definitely some issues with files ending up with contents of other files, particularly with sparse files and nearly full disks, presumably due to new allocations not being zeroed. Hard to replicate, but not impossible. We filed a bug and it was closed as a duplicate. Possibly fixed in todays 10.3.4 release, can't confirm yet.
- aeontech 9y agoWhat was the openradar id, out of curiosity? That sounds really disconcerting
- ams6110 9y agoGood illustration of why command line utilities should not take passwords as a parameter. They should always be provided as prompted input or via a pipe if it needs to be scripted.
- pdfpro 9y ago"encrypted plaintext"