Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MacOS FileVault2 Password Retrieval

blog.frizk.net

Post reply on HN
Print view View original

31–40 of 90 posts

Re: MacOS FileVault2 Password Retrieval

#31

Post by Matt8109 »

gommm wrote: post #11
teddyh wrote: post #9

Earlier quoted context omitted.

Even though the computer may be “locked”, if the OS is running and accessing the disk, it means that the key is present somewhere in memory. There are various methods of accessing this key, the fallback brute-force method being the ( https://en.wikipedia.org/wiki/Cold_boot_attack ). The method from the article only removes the need to physically remove and cool the memory chips.

Ok, I thought that Apple would scrub all keys from memory when the computer goes to sleep so that a computer that's asleep would not be vulnerable to the Cold Boot Attack. Seems strange they don't do that? Or would it make waking up too slow?

My understanding is that it is configurable on macOS by enabling destroyfvkeyonstandby.

https://derflounder.wordpress.com/2014/02/12/power-nap-power...

Re: MacOS FileVault2 Password Retrieval

#32

Post by scblock »

pjmlp wrote: post #21
mtgx wrote: post #13

Earlier quoted context omitted.

I don't know about Apple but Microsoft has a pretty nasty way of handling user's Bitlocker keys. If you use a Microsoft account, your key is automatically backed-up in Microsoft's cloud. Red flag #1. Also, as the recent Bitlocker bypass "bug" showed us, Microsoft has some way of bypassing Bitlocker encryption when it performs updates on the system. I don't know if they have some kind of key escrow or what, but either…

A PC + "expensive Windows professional license" is still cheaper than a Mac.

This is not really relevant to the discussion, or even fully accurate. Most people who buy windows licenses (including me) buy one of the base licenses because we generally don't need the other "professional" features on our home computers.

Re: MacOS FileVault2 Password Retrieval

#33

Post by falcolas »

eeeeeeeeeeeee wrote: post #17

Although this is an exploit and should be fixed, FDE rarely works if your computer is on / sleeping. Same thing with the iPhone. Even though it has solid FDE, there have been exploits if the phone is on (even with a passcode, etc). Turning off your device is the best protection, even if you have FDE.

Well, I'd say "Turning off your device is the only protection when you have FDE", since shutting off your computer will do nothing to protect it if you don't have FDE enabled.

If it's not encrypted, connecting another computer to it with an appropriate cable will let you use it as a remote disk, leaving no real traces that it was touched.

Re: MacOS FileVault2 Password Retrieval

#34

Post by KirinDave »

Good hack, good on Apple for getting fixes out.

But what worries me somewhat is that the tools for mitigation for these families of attacks include a lot of technologies that are traditionally opposed by the community here on the grounds that it "takes away control from the user.

I'm not sure how we balance out those tensions, but attacks like this sure as heck concern me about my homebuilt machine. I do my best not to keep any important keys there.

Re: MacOS FileVault2 Password Retrieval

#35

Post by wlesieutre »

nicolas_t wrote: post #27
wlesieutre wrote: post #23

Earlier quoted context omitted.

Discussion of the caps lock solo/chorded feature here: https://github.com/tekezo/Karabiner-Elements/pull/170#issuec... Looks like it's not in master, but somebody has builds that do it.

Thanks wlesieutre! I had looked in the issues but somehow missed that pull request. Now I can use Sierra :)

Happy to help!

Re: MacOS FileVault2 Password Retrieval

#36

Post by ukblewis »

mtgx wrote: post #13
tptacek wrote: post #4

Things like this are a reason I unhesitatingly recommend that people stick with their OS's built in FDE: 1. FDE is extremely limited. This particular attack is a clever abuse of sleep/reboot cycles, but of course people intimately familiar with FDE know that if a laptop is sleeping but not shut down it's already perilously close to the boundary at which FDE breaks down. And, of course, once it's woken up and unlocked…

I don't know about Apple but Microsoft has a pretty nasty way of handling user's Bitlocker keys. If you use a Microsoft account, your key is automatically backed-up in Microsoft's cloud. Red flag #1. Also, as the recent Bitlocker bypass "bug" showed us, Microsoft has some way of bypassing Bitlocker encryption when it performs updates on the system. I don't know if they have some kind of key escrow or what, but either…

You can optionally store your FDE key on Apple's iCloud, but Apple makes it extremely clear what it is doing and offers to let you do so or not do so.

Re: MacOS FileVault2 Password Retrieval

#37

Post by g00gler »

mtgx wrote: post #13
tptacek wrote: post #4

Things like this are a reason I unhesitatingly recommend that people stick with their OS's built in FDE: 1. FDE is extremely limited. This particular attack is a clever abuse of sleep/reboot cycles, but of course people intimately familiar with FDE know that if a laptop is sleeping but not shut down it's already perilously close to the boundary at which FDE breaks down. And, of course, once it's woken up and unlocked…

I don't know about Apple but Microsoft has a pretty nasty way of handling user's Bitlocker keys. If you use a Microsoft account, your key is automatically backed-up in Microsoft's cloud. Red flag #1. Also, as the recent Bitlocker bypass "bug" showed us, Microsoft has some way of bypassing Bitlocker encryption when it performs updates on the system. I don't know if they have some kind of key escrow or what, but either…

Right-o about using the built in FDE. It's kind of funny to think about how many lay users walk around thinking their laptop is safely protected by a password.

My girlfriend was shocked at how easily I was able to "hack" her laptop and reset the forgotten password by changing whatever accessibility.exe to cmd.exe.

Re: MacOS FileVault2 Password Retrieval

#39

Post by artursapek »

KirinDave wrote: post #34

Good hack, good on Apple for getting fixes out. But what worries me somewhat is that the tools for mitigation for these families of attacks include a lot of technologies that are traditionally opposed by the community here on the grounds that it "takes away control from the user. I'm not sure how we balance out those tensions, but attacks like this sure as heck concern me about my homebuilt machine. I do my best not…

You have a homebuilt mac? Like a hackintosh? If so, I'm pretty sure Apple doesn't owe you any kind of security assurances.

Re: MacOS FileVault2 Password Retrieval

#40

Post by soneil »

tptacek wrote: post #16
nicolas_t wrote: post #6

Earlier quoted context omitted.

> And, of course, once it's woken up and unlocked --- which every attacker who actually challenges FDE can arrange for, all bets are off. I'm not sure what you mean by that? Do you mean that the attacker can force you to wake up and unlock the computer? In that case FDE is not moot anyway, no? For me, the reason I use FDE is in the case I lose or forget my computer somewhere, I do not want the legal liabilities with…

Assume that there are generally two kinds of physical attackers: * Casual, opportunistic attackers who will steal any available laptop. * Targeted attackers who want your laptop in particular. Against a casual attacker, even if your laptop is stolen unlocked, it's not going to be carefully kept unlocked. Doing so requires sophistication, care, and extra risk. Instead, the laptop is just going to get wiped. Against a…

There was a similar, bar less dramatic, case in the UK recently - where police swiped the phone from the hands of a suspect as he took a call, and then kept interacting with the screen to keep it unlocked long enough to recover the evidence required.

In retrospect, it's a pretty obvious attack vector.

Post reply on HN