Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MacOS FileVault2 Password Retrieval

blog.frizk.net

Post reply on HN
Print view View original

21–30 of 90 posts

Re: MacOS FileVault2 Password Retrieval

#21

Post by pjmlp »

mtgx wrote: post #13
tptacek wrote: post #4

Things like this are a reason I unhesitatingly recommend that people stick with their OS's built in FDE: 1. FDE is extremely limited. This particular attack is a clever abuse of sleep/reboot cycles, but of course people intimately familiar with FDE know that if a laptop is sleeping but not shut down it's already perilously close to the boundary at which FDE breaks down. And, of course, once it's woken up and unlocked…

I don't know about Apple but Microsoft has a pretty nasty way of handling user's Bitlocker keys. If you use a Microsoft account, your key is automatically backed-up in Microsoft's cloud. Red flag #1. Also, as the recent Bitlocker bypass "bug" showed us, Microsoft has some way of bypassing Bitlocker encryption when it performs updates on the system. I don't know if they have some kind of key escrow or what, but either…

A PC + "expensive Windows professional license" is still cheaper than a Mac.

Re: MacOS FileVault2 Password Retrieval

#22

Post by ysleepy »

I'm interested in how this was fixed.

Is the update an EFI update which disables DMA or does it with IOMMU? Or is the memory just overwritten on boot?

I'm also quite surprised they leave the password in memory in multiple locations. - Assuming the password is only used to derive the KEK for the actual key.

Re: MacOS FileVault2 Password Retrieval

#23

Post by wlesieutre »

nicolas_t wrote: post #14
wlesieutre wrote: post #12

Earlier quoted context omitted.

Is Karabiner Elements missing features you need? https://github.com/tekezo/Karabiner-Elements I haven't tried it because I can't find the wireless mouse that I needed Karabiner for, but my impression was it has most of the functionality running, especially the key/button remapping which seems to be their biggest use case.

I haven't found a way to configure Karabiner Elements to replace Caps lock with Escape when I only press that key (for vim) and with Ctrl when I press it in combination with other keys (for the terminal). I also have both Shift keys bound to () when pressed alone and Shift when pressed in combination with other keys.

Discussion of the caps lock solo/chorded feature here: https://github.com/tekezo/Karabiner-Elements/pull/170#issuec...

Looks like it's not in master, but somebody has builds that do it.

Re: MacOS FileVault2 Password Retrieval

#25

Post by mnadkvlb »

nicolas_t wrote: post #14
wlesieutre wrote: post #12

Earlier quoted context omitted.

Is Karabiner Elements missing features you need? https://github.com/tekezo/Karabiner-Elements I haven't tried it because I can't find the wireless mouse that I needed Karabiner for, but my impression was it has most of the functionality running, especially the key/button remapping which seems to be their biggest use case.

I haven't found a way to configure Karabiner Elements to replace Caps lock with Escape when I only press that key (for vim) and with Ctrl when I press it in combination with other keys (for the terminal). I also have both Shift keys bound to () when pressed alone and Shift when pressed in combination with other keys.

Thanks for the use-case, i am really fascinated to use this from now on. Working with vim would be awesome.

Re: MacOS FileVault2 Password Retrieval

#26

Post by dom0 »

ysleepy wrote: post #22

I'm interested in how this was fixed. Is the update an EFI update which disables DMA or does it with IOMMU? Or is the memory just overwritten on boot? I'm also quite surprised they leave the password in memory in multiple locations. - Assuming the password is only used to derive the KEK for the actual key.

This interests me, too. I can only assume, since disabling DMA would imply a huge performance hit (and quite likely many broken devices?), that the update enables the IOMMU right from the system start, probably directly in the firmware, and has nothing/only a whitelist mapped, with further mappings only explicitly enabled by drivers?

Re: MacOS FileVault2 Password Retrieval

#27

Post by nicolas_t »

wlesieutre wrote: post #23
nicolas_t wrote: post #14

Earlier quoted context omitted.

I haven't found a way to configure Karabiner Elements to replace Caps lock with Escape when I only press that key (for vim) and with Ctrl when I press it in combination with other keys (for the terminal). I also have both Shift keys bound to () when pressed alone and Shift when pressed in combination with other keys.

Discussion of the caps lock solo/chorded feature here: https://github.com/tekezo/Karabiner-Elements/pull/170#issuec... Looks like it's not in master, but somebody has builds that do it.

Thanks wlesieutre! I had looked in the issues but somehow missed that pull request. Now I can use Sierra :)

Re: MacOS FileVault2 Password Retrieval

#28

Post by feld »

ysleepy wrote: post #22

I'm interested in how this was fixed. Is the update an EFI update which disables DMA or does it with IOMMU? Or is the memory just overwritten on boot? I'm also quite surprised they leave the password in memory in multiple locations. - Assuming the password is only used to derive the KEK for the actual key.

This exact command:

sudo firmwarepasswd -setpasswd -setmode command

enter in a password to lock down Option ROM, reboot. Now you're protected.

source, the hacker-now-Apple-developer: https://twitter.com/XenoKovah/status/809418554428657666

Re: MacOS FileVault2 Password Retrieval

#29

Post by 6DM »

tptacek wrote: post #16
nicolas_t wrote: post #6

Earlier quoted context omitted.

> And, of course, once it's woken up and unlocked --- which every attacker who actually challenges FDE can arrange for, all bets are off. I'm not sure what you mean by that? Do you mean that the attacker can force you to wake up and unlock the computer? In that case FDE is not moot anyway, no? For me, the reason I use FDE is in the case I lose or forget my computer somewhere, I do not want the legal liabilities with…

Assume that there are generally two kinds of physical attackers: * Casual, opportunistic attackers who will steal any available laptop. * Targeted attackers who want your laptop in particular. Against a casual attacker, even if your laptop is stolen unlocked, it's not going to be carefully kept unlocked. Doing so requires sophistication, care, and extra risk. Instead, the laptop is just going to get wiped. Against a…

I was curious about that, so I looked it up. Pretty interesting stuff.

[0] "On the afternoon of October 1, 2013, officers watched as Ulbricht entered the library and made his way up the stairs to work by the window at a desk in the science fiction section, Kiernan recalled. Meanwhile, sitting on a bench outside of the library, homeland security officer Jared Der-Yeghiayan — who had been working undercover as Silk Road employee "cirrus" — initiated a chat with Ulbricht, requesting that he log in to Silk Road's back end to fix a technical problem. As soon as Der-Yeghiayan could confirm that Ulbricht was logged into the site, FBI agents entered the library.

Two plainclothes FBI agents, one male and one female, walked up behind Ulbricht and began arguing loudly. This staged lovers' tiff caught Ulbricht's attention long enough to distract him from his laptop. As soon as Ulbricht looked up, the male agent reached down and slid the computer over to his female colleague, who quickly snatched it up and handed it over to Kiernan for further investigation."

[0] http://www.businessinsider.com/ross-ulbricht-will-be-sentenc...

Re: MacOS FileVault2 Password Retrieval

#30

Post by [deleted] »

tptacek wrote: post #16
nicolas_t wrote: post #6

Earlier quoted context omitted.

> And, of course, once it's woken up and unlocked --- which every attacker who actually challenges FDE can arrange for, all bets are off. I'm not sure what you mean by that? Do you mean that the attacker can force you to wake up and unlock the computer? In that case FDE is not moot anyway, no? For me, the reason I use FDE is in the case I lose or forget my computer somewhere, I do not want the legal liabilities with…

Assume that there are generally two kinds of physical attackers: * Casual, opportunistic attackers who will steal any available laptop. * Targeted attackers who want your laptop in particular. Against a casual attacker, even if your laptop is stolen unlocked, it's not going to be carefully kept unlocked. Doing so requires sophistication, care, and extra risk. Instead, the laptop is just going to get wiped. Against a…

[deleted]
Post reply on HN