5 ms·

> You used to be able to get the password of encrypted home directories from the page file with a simple grep command You already have to be root to do this.

by zepto 6y ago

> You used to be able to get the password of encrypted home directories from the page file with a simple grep command You already have to be root to do this. This tells you nothing about Mac security.

smoldesu 6y ago
You're thinking of the shadow file, which I don't believe OP is referring to.
13415 6y ago
Right, no need to encrypt anything, just don't set any read permissions. Problem solved!
- zepto 6y ago
  Nobody is saying this other than you.
  - 13415 6y ago
    You insinuated it, though, by claiming that it wasn't a security problem as it required root. If you think failure to encrypt (leaking the passphrase) is not a problem because the exploit requires root, then you understand absolutely nothing about security. By the way, the reason why I mentioned this particular example is that it almost certainly proves malicious intent. It is not credible that a team of security engineers at Apple developed file vault without thinking at all about locking memory for the passphrase and then continued not to think about it for years. They basically only fixed it (and first even in the wrong way) after it became folklore on every second Mac fan site. (Lost your file vault password? Don't despair: Just copy & paste this in the terminal.) There is 0 reason to trust Apple on security.
    - zepto 6y ago
      > You insinuated it, though by claiming that it wasn't a security problem as it required root I did make any such claim. You are seeing things where they aren’t. Encryption at rest is very important. However, it’s worth putting different risks into perspective. What you can do if you have root, simply is a different category of risk than what you can do without. Pointing that out insinuates nothing. > By the way, the reason why I mentioned this particular example is that it almost certainly proves malicious intent. Obviously not, because otherwise they wouldn’t have fixed it. That you can find a security problem from the past that has now been fixed, is the precise opposite of evidence that a company doesn’t care about security.
      - 13415 6y ago
        Okay, okay. You insinuated nothing. I stand corrected. Just a little side note: You didn't need root for the exploit, it was also trivial to boot from a CD or another OS to get the passphrase from the page file. Basically it meant that file vault was useless for many years. Anyway, you're kind of missing my point. There are plenty of other examples of Apple not addressing security issues in time. Be that as it may, if you feel secure about your Mac, who am I to argue with that...
        zepto 6y ago
        Ok - physical without root definitely makes it worse, but it’s still not open to a remote exploit. Yes, some people need worry about people entering their office to steal their home directories, but it’s not a simple thing to exploit. Apple is quite slow to address certain issues, but on the whole end user security is still excellent for most end-users now.
        13415 6y ago
        Well, the whole point of encrypted home directories is to secure the data when the user is not logged in and does not attend the machine...
        zepto 6y ago
netsec_burn 6y ago
I'm a different security guy from the one above. I have a root exploit in macOS that Apple has refused to discuss with me for half a year. I told them it affected Big Sur (even since the betas) and they were unfazed. I have reached out to everyone I know at Apple to schedule a demo or even a phone call and they've been met with silence from their product security team. How is that for some perspective on Apple's security?
- edoceo 6y ago
  Publish your research
  - netsec_burn 6y ago
    Can't do it if there is no way to keep my lights on and food on my table.
- zepto 6y ago
  Apple routinely interacts with security researchers, and pays bug bounties. It sounds like you haven’t told them any technical details about the exploit, at all. If this is the case, then they have no way to tell you apart from a timewaster or scammer. If all you have done is tell them you have an exploit and tried to schedule a meeting, it’s unlikely they’ll take you seriously.
  - netsec_burn 6y ago
    In fact, I have given them technical details as to what the capabilities are and the affected macOS versions. I refuse to submit all of my research without them telling me roughly what the bounty ranges are for the vulnerabilities in the same class/equivalent impact. I've done many bounty programs in the past. Companies will always choose to pay nothing or close to nothing when it is favorable to them. Apple refuses to share what the bounty ranges are given technical information about it, and asked me to submit the entirety of my research without having any idea of what the compensation may be. So they made it impossible for me and perhaps many others to help improve the security of their OS ethically. For every 1 company that pays you in bug bounties, 10 don't. If you're a security researcher, you can't afford the possibility of getting nothing for months of research.
ric2b 6y ago
Isn't the page file on disk? Can't you just force shutdown and then boot an alternative OS that ignores the file permissions and read it?
- zepto 6y ago
  Who knows - the problem was fixed long ago.
  - brokenmachine 6y ago
    Then why did you write in italics to emphasize that you already have to be root, if you were so unsure?
lofi_lory 6y ago
On many systems you were able to get root access by simply leaving the password empty. While relevant getting root is still different from getting the encryption keys.
- zepto 6y ago
  What systems, and when?
  - lofi_lory 6y ago
    https://www.theguardian.com/technology/2017/nov/29/macos-high-sierra-bug-apple-mac-unlock-blank-password-security-flaw https://www.theguardian.com/technology/2017/nov/29/macos-hig...
    - zepto 6y ago
      Doesn’t seem like it was ‘many systems’. It’s a very severe bug, for sure, but it wasn’t long-standing and looks like it only affected a small number of versions before it was fixed.
MertsA 6y ago
And you would also already need root for encrypting the home directory to even matter in the first place. Leaving the password on disk right next to the encrypted content is on par with leaving the keys in a fancy locked safe. It completely nullifies the whole point of the added security to begin with. I'm an amateur when it comes to application security yet even I know that you should mlock() your secret data addresses and never pass secret data through command line arguments. Both trivial mistakes that Apple has made with FileVault. They even shipped code that would set the password hint to the actual password. How are their security standards so lax to have missed all of that in their encryption software alone?

by zepto 6y ago

smoldesu 6y ago

You're thinking of the shadow file, which I don't believe OP is referring to.

13415 6y ago

Right, no need to encrypt anything, just don't set any read permissions. Problem solved!

zepto 6y ago
Nobody is saying this other than you.
- 13415 6y ago
  You insinuated it, though, by claiming that it wasn't a security problem as it required root. If you think failure to encrypt (leaking the passphrase) is not a problem because the exploit requires root, then you understand absolutely nothing about security. By the way, the reason why I mentioned this particular example is that it almost certainly proves malicious intent. It is not credible that a team of security engineers at Apple developed file vault without thinking at all about locking memory for the passphrase and then continued not to think about it for years. They basically only fixed it (and first even in the wrong way) after it became folklore on every second Mac fan site. (Lost your file vault password? Don't despair: Just copy & paste this in the terminal.) There is 0 reason to trust Apple on security.
  - zepto 6y ago
    > You insinuated it, though by claiming that it wasn't a security problem as it required root I did make any such claim. You are seeing things where they aren’t. Encryption at rest is very important. However, it’s worth putting different risks into perspective. What you can do if you have root, simply is a different category of risk than what you can do without. Pointing that out insinuates nothing. > By the way, the reason why I mentioned this particular example is that it almost certainly proves malicious intent. Obviously not, because otherwise they wouldn’t have fixed it. That you can find a security problem from the past that has now been fixed, is the precise opposite of evidence that a company doesn’t care about security.
    - 13415 6y ago
      Okay, okay. You insinuated nothing. I stand corrected. Just a little side note: You didn't need root for the exploit, it was also trivial to boot from a CD or another OS to get the passphrase from the page file. Basically it meant that file vault was useless for many years. Anyway, you're kind of missing my point. There are plenty of other examples of Apple not addressing security issues in time. Be that as it may, if you feel secure about your Mac, who am I to argue with that...
      - zepto 6y ago
        Ok - physical without root definitely makes it worse, but it’s still not open to a remote exploit. Yes, some people need worry about people entering their office to steal their home directories, but it’s not a simple thing to exploit. Apple is quite slow to address certain issues, but on the whole end user security is still excellent for most end-users now.
        13415 6y ago
        Well, the whole point of encrypted home directories is to secure the data when the user is not logged in and does not attend the machine...
        zepto 6y ago

netsec_burn 6y ago

I'm a different security guy from the one above. I have a root exploit in macOS that Apple has refused to discuss with me for half a year. I told them it affected Big Sur (even since the betas) and they were unfazed. I have reached out to everyone I know at Apple to schedule a demo or even a phone call and they've been met with silence from their product security team. How is that for some perspective on Apple's security?

edoceo 6y ago
Publish your research
- netsec_burn 6y ago
  Can't do it if there is no way to keep my lights on and food on my table.
zepto 6y ago
Apple routinely interacts with security researchers, and pays bug bounties. It sounds like you haven’t told them any technical details about the exploit, at all. If this is the case, then they have no way to tell you apart from a timewaster or scammer. If all you have done is tell them you have an exploit and tried to schedule a meeting, it’s unlikely they’ll take you seriously.
- netsec_burn 6y ago
  In fact, I have given them technical details as to what the capabilities are and the affected macOS versions. I refuse to submit all of my research without them telling me roughly what the bounty ranges are for the vulnerabilities in the same class/equivalent impact. I've done many bounty programs in the past. Companies will always choose to pay nothing or close to nothing when it is favorable to them. Apple refuses to share what the bounty ranges are given technical information about it, and asked me to submit the entirety of my research without having any idea of what the compensation may be. So they made it impossible for me and perhaps many others to help improve the security of their OS ethically. For every 1 company that pays you in bug bounties, 10 don't. If you're a security researcher, you can't afford the possibility of getting nothing for months of research.

ric2b 6y ago

Isn't the page file on disk? Can't you just force shutdown and then boot an alternative OS that ignores the file permissions and read it?

zepto 6y ago
Who knows - the problem was fixed long ago.
- brokenmachine 6y ago
  Then why did you write in italics to emphasize that you already have to be root, if you were so unsure?

lofi_lory 6y ago

On many systems you were able to get root access by simply leaving the password empty. While relevant getting root is still different from getting the encryption keys.

zepto 6y ago
What systems, and when?
- lofi_lory 6y ago
  https://www.theguardian.com/technology/2017/nov/29/macos-high-sierra-bug-apple-mac-unlock-blank-password-security-flaw https://www.theguardian.com/technology/2017/nov/29/macos-hig...
  - zepto 6y ago
    Doesn’t seem like it was ‘many systems’. It’s a very severe bug, for sure, but it wasn’t long-standing and looks like it only affected a small number of versions before it was fixed.

MertsA 6y ago

And you would also already need root for encrypting the home directory to even matter in the first place. Leaving the password on disk right next to the encrypted content is on par with leaving the keys in a fancy locked safe. It completely nullifies the whole point of the added security to begin with. I'm an amateur when it comes to application security yet even I know that you should mlock() your secret data addresses and never pass secret data through command line arguments. Both trivial mistakes that Apple has made with FileVault. They even shipped code that would set the password hint to the actual password. How are their security standards so lax to have missed all of that in their encryption software alone?