Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MacOS FileVault2 Password Retrieval

blog.frizk.net

Post reply on HN
Print view View original

51–60 of 90 posts

Re: MacOS FileVault2 Password Retrieval

#51

Post by dogma1138 »

DINKDINK wrote: post #47
tptacek wrote: post #16

Earlier quoted context omitted.

Assume that there are generally two kinds of physical attackers: * Casual, opportunistic attackers who will steal any available laptop. * Targeted attackers who want your laptop in particular. Against a casual attacker, even if your laptop is stolen unlocked, it's not going to be carefully kept unlocked. Doing so requires sophistication, care, and extra risk. Instead, the laptop is just going to get wiped. Against a…

>the attacker will simply wait until the laptop is unlocked. A potential counter measure is for the machine to periodically encrypt itself again and prevent use until a password/key is supplied ("clamming up"). This would prevent an attacker who snatched a logged-into computer from having unbounded carte blanche access to the machine. I'm envisioning something that every 10 minutes locks itself. Does anyone know of s…

A screen saver (w/ require password & possible full hibernation with memory flush)?

Re: MacOS FileVault2 Password Retrieval

#52

Post by zwily »

baby wrote: post #42
6DM wrote: post #29

Earlier quoted context omitted.

I was curious about that, so I looked it up. Pretty interesting stuff. [0] "On the afternoon of October 1, 2013, officers watched as Ulbricht entered the library and made his way up the stairs to work by the window at a desk in the science fiction section, Kiernan recalled. Meanwhile, sitting on a bench outside of the library, homeland security officer Jared Der-Yeghiayan — who had been working undercover as Silk Roa…

If they made a movie about Snowden, they will surely made a movie about this.

Yup: http://www.theverge.com/2016/10/14/13290460/coen-brothers-si...

Re: MacOS FileVault2 Password Retrieval

#53

Post by eeeeeeeeeeeee »

falcolas wrote: post #33
eeeeeeeeeeeee wrote: post #17

Although this is an exploit and should be fixed, FDE rarely works if your computer is on / sleeping. Same thing with the iPhone. Even though it has solid FDE, there have been exploits if the phone is on (even with a passcode, etc). Turning off your device is the best protection, even if you have FDE.

Well, I'd say "Turning off your device is the only protection when you have FDE", since shutting off your computer will do nothing to protect it if you don't have FDE enabled. If it's not encrypted, connecting another computer to it with an appropriate cable will let you use it as a remote disk, leaving no real traces that it was touched.

Uhh, I think that was pretty clear from my comment. FDE only gives you "complete" security in transit if you shut it off. Leaving a FDE computer in sleep mode will not protect you.

But even in sleep mode, a FDE computer is still better than no encryption at all.

Re: MacOS FileVault2 Password Retrieval

#54

Post by dashesyan »

I've had this in my .profile for years:

  alias sleepsafe='sudo pmset -a destroyfvkeyonstandby 1 hibernatemode 25'
  alias sleepfast='sudo pmset -a hibernatemode 0'
  alias sleepdefault='sudo pmset -a hibernatemode 3'
Whenever I travel or need to leave my laptop, I always run `sleepsafe`, which will delete the key from memory and hibernate the computer when I close the lid. It has the added benefit of saving battery life.

Day-to-day, I use `sleepfast`, which is faster than the default hybrid sleep, because it doesn't spend time copying the contents of memory to disk.

I very rarely switch to `sleepdefault` which is the insecure and slower hybrid sleep.

This has been a known issue for years http://osxdaily.com/2013/07/06/maximize-filevault-security-d... https://nakedsecurity.sophos.com/2012/02/02/filevault-encryp...

Re: MacOS FileVault2 Password Retrieval

#56

Post by j_s »

dashesyan wrote: post #54

I've had this in my .profile for years: alias sleepsafe='sudo pmset -a destroyfvkeyonstandby 1 hibernatemode 25' alias sleepfast='sudo pmset -a hibernatemode 0' alias sleepdefault='sudo pmset -a hibernatemode 3' Whenever I travel or need to leave my laptop, I always run `sleepsafe`, which will delete the key from memory and hibernate the computer when I close the lid. It has the added benefit of saving battery life.…

Thanks for sharing these awesome shortcuts!

Are there any caveats that I should be aware of before just stealing this to use for myself?

Re: MacOS FileVault2 Password Retrieval

#57

Post by alexpoulsen »

Someone wrote: post #46
soneil wrote: post #40

Earlier quoted context omitted.

There was a similar, bar less dramatic, case in the UK recently - where police swiped the phone from the hands of a suspect as he took a call, and then kept interacting with the screen to keep it unlocked long enough to recover the evidence required. In retrospect, it's a pretty obvious attack vector.

A dead man's switch with a very short time-out would make that kind of attack a lot harder. For the extremely security-conscious, it could even be a kind of fail-deadly ( https://en.wikipedia.org/wiki/Fail-deadly ) feature that wipes the phone.

https://github.com/hephaest0s/usbkill Checks for changes with USB drives and shuts down the computer and optionally deletes files and wipes ram. USB stick on a wristband > unplugs when they take the computer > shuts down

Re: MacOS FileVault2 Password Retrieval

#58

Post by mapgrep »

mweibel wrote: post #15
nicolas_t wrote: post #3

Has Apple released patches for El Capitan? I'm still using it instead of Sierra because of Karabiner but this could force me to upgrade. That vulnerability seems to be a pretty obvious oversight. I remember hearing about DMA (in the context of Firewire) as an attack vector since people first started talking of Truecrypt and Filevault and scrubbing the memory seems obvious... It's worrying that this could have been ov…

If that's the update: https://support.apple.com/en-us/HT207423 then yes.

That changelog includes a bunch of fixes that are Sierra only, so the answer may be "no" contrary to your comment.

This is the closest I can find on there to this issue and the fix is Sierra only:

IOFireWireFamily Available for: macOS Sierra 10.12.1 Impact: A local attacker may be able to read kernel memory Description: A memory corruption issue was addressed through improved memory handling. CVE-2016-7608: Brandon Azad

Attribution on that doesn;t look right; TFA was by "Ulf Frisk" who was nowhere on that page.

Why would someone be using El Capitan still, some may ask. Well there is software not updated for Sierra yet. For example, GPG for Mac is not yet ported over.

Re: MacOS FileVault2 Password Retrieval

#60

Post by jonknee »

partiallogic wrote: post #55
mkj wrote: post #5

Did a firmware password prevent it? The same problem with FireWire was prevented by that (a decade ago)

Would really want to know this as not everyone wants to upgrade their OSX

> Would really want to know this as not everyone wants to upgrade their OSX

Anyone who wants to stay secure should want to upgrade their system...

Post reply on HN