4 ms·

False, and has been false for at least 4 years. This vulnerability was unexpected and resolved in the next release of the OS, which allowed this memory to be k

by nirvana 14y ago

False, and has been false for at least 4 years. This vulnerability was unexpected and resolved in the next release of the OS, which allowed this memory to be kept encrypted.

werrett 14y ago
Not false I'm afraid. I use this issue to grab FileVault passwords from OSX boxes on a monthly basis. In combination with DMA access from the Firewire port it can be quite fun[1]. Although with Lion, you can't use DMA when the machine is locked. "Secure Virtual Memory" only does just that -- Encrypts the memory that is being swapped out to your disk. I've never done a memory dump and found the FileVault password has been swapped out. Probably because it is being used all the time to secure disk read/writes. The latest OSX really is behind the latest Windows on the security front. Windows has just been the focus of intense hammering on that front over many many years and they've been force to improve their game. And I say this as a mac user, as 99% of my pentester colleagues are. [1]: http://www.breaknenter.org/projects/inception/ http://www.breaknenter.org/projects/inception/