3 ms·

As has been discussed here, FileVault decryption passwords are stored in plain text in RAM that is easily found by a scanner attached to the firewire port. Fixi

As has been discussed here, FileVault decryption passwords are stored in plain text in RAM that is easily found by a scanner attached to the firewire port. Fixing this is not difficult, it's simply a matter of NOT storing encryption passwords in plaintext in RAM, but in a register instead. This is just one of countless numbers of critical vulnerabilities in the system that are known and completely ignored as "works per spec" when reported. This is definitely by design, for many government agencies use automated hacking devices that take advantage of these vulnerabilities to gain access to machines, such as when passing through customs, or when stopped by police. The vulnerabilities are desired and doing what they are supposed to - providing a false sense of security.

ceph_ 15y ago
Secure virtual memory has been an option since pre leopard. In lion it's enabled by default and they removed the menu option to disable it.
- replax 15y ago
  As you said, secure VIRTUAL memory refers to swapped memory. Meaning it is encrypted when it is written to disk. Seeing as the password is probably in near constant use, it will never be written to disk and therefore stays UNENCRYPTED in ram...
nirvana 15y ago
False, and has been false for at least 4 years. This vulnerability was unexpected and resolved in the next release of the OS, which allowed this memory to be kept encrypted.
- werrett 15y ago
  Not false I'm afraid. I use this issue to grab FileVault passwords from OSX boxes on a monthly basis. In combination with DMA access from the Firewire port it can be quite fun[1]. Although with Lion, you can't use DMA when the machine is locked. "Secure Virtual Memory" only does just that -- Encrypts the memory that is being swapped out to your disk. I've never done a memory dump and found the FileVault password has been swapped out. Probably because it is being used all the time to secure disk read/writes. The latest OSX really is behind the latest Windows on the security front. Windows has just been the focus of intense hammering on that front over many many years and they've been force to improve their game. And I say this as a mac user, as 99% of my pentester colleagues are. [1]: http://www.breaknenter.org/projects/inception/ http://www.breaknenter.org/projects/inception/
deleted 15y ago
[deleted]

ceph_ 15y ago

Secure virtual memory has been an option since pre leopard. In lion it's enabled by default and they removed the menu option to disable it.

replax 15y ago
As you said, secure VIRTUAL memory refers to swapped memory. Meaning it is encrypted when it is written to disk. Seeing as the password is probably in near constant use, it will never be written to disk and therefore stays UNENCRYPTED in ram...

nirvana 15y ago

False, and has been false for at least 4 years. This vulnerability was unexpected and resolved in the next release of the OS, which allowed this memory to be kept encrypted.

werrett 15y ago
Not false I'm afraid. I use this issue to grab FileVault passwords from OSX boxes on a monthly basis. In combination with DMA access from the Firewire port it can be quite fun[1]. Although with Lion, you can't use DMA when the machine is locked. "Secure Virtual Memory" only does just that -- Encrypts the memory that is being swapped out to your disk. I've never done a memory dump and found the FileVault password has been swapped out. Probably because it is being used all the time to secure disk read/writes. The latest OSX really is behind the latest Windows on the security front. Windows has just been the focus of intense hammering on that front over many many years and they've been force to improve their game. And I say this as a mac user, as 99% of my pentester colleagues are. [1]: http://www.breaknenter.org/projects/inception/ http://www.breaknenter.org/projects/inception/

deleted 15y ago

[deleted]