Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MacOS FileVault2 Password Retrieval

blog.frizk.net

Post reply on HN
Print view View original

41–50 of 90 posts

Re: MacOS FileVault2 Password Retrieval

#41

Post by djrogers »

artursapek wrote: post #39
KirinDave wrote: post #34

Good hack, good on Apple for getting fixes out. But what worries me somewhat is that the tools for mitigation for these families of attacks include a lot of technologies that are traditionally opposed by the community here on the grounds that it "takes away control from the user. I'm not sure how we balance out those tensions, but attacks like this sure as heck concern me about my homebuilt machine. I do my best not…

You have a homebuilt mac? Like a hackintosh? If so, I'm pretty sure Apple doesn't owe you any kind of security assurances.

DMA attacks are potentially possible on more than just macs

Re: MacOS FileVault2 Password Retrieval

#42

Post by baby »

6DM wrote: post #29
tptacek wrote: post #16

Earlier quoted context omitted.

Assume that there are generally two kinds of physical attackers: * Casual, opportunistic attackers who will steal any available laptop. * Targeted attackers who want your laptop in particular. Against a casual attacker, even if your laptop is stolen unlocked, it's not going to be carefully kept unlocked. Doing so requires sophistication, care, and extra risk. Instead, the laptop is just going to get wiped. Against a…

I was curious about that, so I looked it up. Pretty interesting stuff. [0] "On the afternoon of October 1, 2013, officers watched as Ulbricht entered the library and made his way up the stairs to work by the window at a desk in the science fiction section, Kiernan recalled. Meanwhile, sitting on a bench outside of the library, homeland security officer Jared Der-Yeghiayan — who had been working undercover as Silk Roa…

If they made a movie about Snowden, they will surely made a movie about this.

Re: MacOS FileVault2 Password Retrieval

#43

Post by nicholasserra »

nicolas_t wrote: post #3

Has Apple released patches for El Capitan? I'm still using it instead of Sierra because of Karabiner but this could force me to upgrade. That vulnerability seems to be a pretty obvious oversight. I remember hearing about DMA (in the context of Firewire) as an attack vector since people first started talking of Truecrypt and Filevault and scrubbing the memory seems obvious... It's worrying that this could have been ov…

Doesn't seem like the patch is for El Capitan, as all the kernel fixes only list Sierra.

Re: MacOS FileVault2 Password Retrieval

#45

Post by appledude »

therealmarv wrote: post #19

Is this the main reason why the Kernel Version number increased with macOS 10.12.2 ?

The kernel version was incremented due to kernel fixes (https://support.apple.com/en-us/HT207423). The Filevault vulnerability was fixed in 10.12.2 with a firmware update, part of the incremental update.

Re: MacOS FileVault2 Password Retrieval

#46

Post by Someone »

soneil wrote: post #40
tptacek wrote: post #16

Earlier quoted context omitted.

Assume that there are generally two kinds of physical attackers: * Casual, opportunistic attackers who will steal any available laptop. * Targeted attackers who want your laptop in particular. Against a casual attacker, even if your laptop is stolen unlocked, it's not going to be carefully kept unlocked. Doing so requires sophistication, care, and extra risk. Instead, the laptop is just going to get wiped. Against a…

There was a similar, bar less dramatic, case in the UK recently - where police swiped the phone from the hands of a suspect as he took a call, and then kept interacting with the screen to keep it unlocked long enough to recover the evidence required. In retrospect, it's a pretty obvious attack vector.

A dead man's switch with a very short time-out would make that kind of attack a lot harder.

For the extremely security-conscious, it could even be a kind of fail-deadly (https://en.wikipedia.org/wiki/Fail-deadly) feature that wipes the phone.

Re: MacOS FileVault2 Password Retrieval

#47

Post by DINKDINK »

tptacek wrote: post #16
nicolas_t wrote: post #6

Earlier quoted context omitted.

> And, of course, once it's woken up and unlocked --- which every attacker who actually challenges FDE can arrange for, all bets are off. I'm not sure what you mean by that? Do you mean that the attacker can force you to wake up and unlock the computer? In that case FDE is not moot anyway, no? For me, the reason I use FDE is in the case I lose or forget my computer somewhere, I do not want the legal liabilities with…

Assume that there are generally two kinds of physical attackers: * Casual, opportunistic attackers who will steal any available laptop. * Targeted attackers who want your laptop in particular. Against a casual attacker, even if your laptop is stolen unlocked, it's not going to be carefully kept unlocked. Doing so requires sophistication, care, and extra risk. Instead, the laptop is just going to get wiped. Against a…

>the attacker will simply wait until the laptop is unlocked.

A potential counter measure is for the machine to periodically encrypt itself again and prevent use until a password/key is supplied ("clamming up"). This would prevent an attacker who snatched a logged-into computer from having unbounded carte blanche access to the machine. I'm envisioning something that every 10 minutes locks itself.

Does anyone know of such a solution?

Re: MacOS FileVault2 Password Retrieval

#48

Post by tptacek »

Someone wrote: post #46
soneil wrote: post #40

Earlier quoted context omitted.

There was a similar, bar less dramatic, case in the UK recently - where police swiped the phone from the hands of a suspect as he took a call, and then kept interacting with the screen to keep it unlocked long enough to recover the evidence required. In retrospect, it's a pretty obvious attack vector.

A dead man's switch with a very short time-out would make that kind of attack a lot harder. For the extremely security-conscious, it could even be a kind of fail-deadly ( https://en.wikipedia.org/wiki/Fail-deadly ) feature that wipes the phone.

See, this is the problem with people's conception of FDE. This is actually a very silly solution to the problem.

The right approach is to recognize what FDE is good at (minimizing the risk that casual thieves will get data in addition to valuable parts, and protecting computers that can frequently be powered all the way off from even advanced attackers), and then use something better to protect sensitive data.

Re: MacOS FileVault2 Password Retrieval

#49

Post by [deleted] »

tptacek wrote: post #16
nicolas_t wrote: post #6

Earlier quoted context omitted.

> And, of course, once it's woken up and unlocked --- which every attacker who actually challenges FDE can arrange for, all bets are off. I'm not sure what you mean by that? Do you mean that the attacker can force you to wake up and unlock the computer? In that case FDE is not moot anyway, no? For me, the reason I use FDE is in the case I lose or forget my computer somewhere, I do not want the legal liabilities with…

Assume that there are generally two kinds of physical attackers: * Casual, opportunistic attackers who will steal any available laptop. * Targeted attackers who want your laptop in particular. Against a casual attacker, even if your laptop is stolen unlocked, it's not going to be carefully kept unlocked. Doing so requires sophistication, care, and extra risk. Instead, the laptop is just going to get wiped. Against a…

[deleted]

Re: MacOS FileVault2 Password Retrieval

#50

Post by raverbashing »

gommm wrote: post #11
teddyh wrote: post #9

Earlier quoted context omitted.

Even though the computer may be “locked”, if the OS is running and accessing the disk, it means that the key is present somewhere in memory. There are various methods of accessing this key, the fallback brute-force method being the ( https://en.wikipedia.org/wiki/Cold_boot_attack ). The method from the article only removes the need to physically remove and cool the memory chips.

Ok, I thought that Apple would scrub all keys from memory when the computer goes to sleep so that a computer that's asleep would not be vulnerable to the Cold Boot Attack. Seems strange they don't do that? Or would it make waking up too slow?

Sleep does not shuts down ram.
Post reply on HN