Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MacOS FileVault2 Password Retrieval

blog.frizk.net

Post reply on HN
Print view View original

61–70 of 90 posts

Re: MacOS FileVault2 Password Retrieval

#61

Post by lstamour »

j_s wrote: post #56
dashesyan wrote: post #54

I've had this in my .profile for years: alias sleepsafe='sudo pmset -a destroyfvkeyonstandby 1 hibernatemode 25' alias sleepfast='sudo pmset -a hibernatemode 0' alias sleepdefault='sudo pmset -a hibernatemode 3' Whenever I travel or need to leave my laptop, I always run `sleepsafe`, which will delete the key from memory and hibernate the computer when I close the lid. It has the added benefit of saving battery life.…

Thanks for sharing these awesome shortcuts! Are there any caveats that I should be aware of before just stealing this to use for myself?

You could read through http://training.apple.com/pdf/WP_FileVault2.pdf for some of the details, or `man pmset`. Use `pmset -g` at any time to see your current settings.

Re: MacOS FileVault2 Password Retrieval

#62

Post by dootdootskeltal »

dashesyan wrote: post #54

I've had this in my .profile for years: alias sleepsafe='sudo pmset -a destroyfvkeyonstandby 1 hibernatemode 25' alias sleepfast='sudo pmset -a hibernatemode 0' alias sleepdefault='sudo pmset -a hibernatemode 3' Whenever I travel or need to leave my laptop, I always run `sleepsafe`, which will delete the key from memory and hibernate the computer when I close the lid. It has the added benefit of saving battery life.…

It doesn't work for me on Sierra, I disabled powernap and it keeps asking for my account password. Also I set standbydelay and standby to 0.

Edit: After some time and some tries, idk why but it started working.

Commands that I used:

$ sudo pmset -a darkwakes 0

$ sudo pmset -a standby 0

$ sudo pmset -a standbydelay 0

Also check that powernap is disabled.

Re: MacOS FileVault2 Password Retrieval

#63

Post by dashesyan »

j_s wrote: post #56
dashesyan wrote: post #54

I've had this in my .profile for years: alias sleepsafe='sudo pmset -a destroyfvkeyonstandby 1 hibernatemode 25' alias sleepfast='sudo pmset -a hibernatemode 0' alias sleepdefault='sudo pmset -a hibernatemode 3' Whenever I travel or need to leave my laptop, I always run `sleepsafe`, which will delete the key from memory and hibernate the computer when I close the lid. It has the added benefit of saving battery life.…

Thanks for sharing these awesome shortcuts! Are there any caveats that I should be aware of before just stealing this to use for myself?

Just make sure you eject any removable disks before hibernating. And, sleepfast may drain your battery faster than the default hybrid sleep

Re: MacOS FileVault2 Password Retrieval

#65

Post by thijsvandien »

appledude wrote: post #44
kevinburke wrote: post #38

Is a 10.11 machine encrypted with FileVault vulnerable to this attack?

Yes, even if you install the December 2016 security update for 10.11.6; only 10.12.2 is protected against this Filevault vuln.

Are you planning to backport the fix? It would be very disappointing if a serious security problem like this would be left unaddressed. Not all of us can or want to switch to the latest major within months after its release.

Re: MacOS FileVault2 Password Retrieval

#66

Post by genesee »

dogma1138 wrote: post #51
DINKDINK wrote: post #47

Earlier quoted context omitted.

>the attacker will simply wait until the laptop is unlocked. A potential counter measure is for the machine to periodically encrypt itself again and prevent use until a password/key is supplied ("clamming up"). This would prevent an attacker who snatched a logged-into computer from having unbounded carte blanche access to the machine. I'm envisioning something that every 10 minutes locks itself. Does anyone know of s…

A screen saver (w/ require password & possible full hibernation with memory flush)?

That's defeated by a USB mouse jiggler [1], which is apparently commonly used by the type of people who seize computers in the wild.

[1] https://www.amazon.com/CRU-Inc-30200-0100-0011-WiebeTech-Jig...

Re: MacOS FileVault2 Password Retrieval

#67

Post by [deleted] »

dogma1138 wrote: post #51
DINKDINK wrote: post #47

Earlier quoted context omitted.

>the attacker will simply wait until the laptop is unlocked. A potential counter measure is for the machine to periodically encrypt itself again and prevent use until a password/key is supplied ("clamming up"). This would prevent an attacker who snatched a logged-into computer from having unbounded carte blanche access to the machine. I'm envisioning something that every 10 minutes locks itself. Does anyone know of s…

A screen saver (w/ require password & possible full hibernation with memory flush)?

[deleted]

Re: MacOS FileVault2 Password Retrieval

#68

Post by rcthompson »

dogma1138 wrote: post #51
DINKDINK wrote: post #47

Earlier quoted context omitted.

>the attacker will simply wait until the laptop is unlocked. A potential counter measure is for the machine to periodically encrypt itself again and prevent use until a password/key is supplied ("clamming up"). This would prevent an attacker who snatched a logged-into computer from having unbounded carte blanche access to the machine. I'm envisioning something that every 10 minutes locks itself. Does anyone know of s…

A screen saver (w/ require password & possible full hibernation with memory flush)?

I think they are talking about a system that unconditionally asks for the password every 10 minutes even while the computer is in active use.

Re: MacOS FileVault2 Password Retrieval

#69

Post by emptybits »

Good on Apple for "completely" fixing this, according to the authors. But am I wrong to wish for more plain-English acknowledgement of the problem and reassurance in Apple's 10.12.2 release notes?

i.e. https://support.apple.com/en-ca/HT207423

Anyways, at this point in time it's nice to read (from the authors of the exploit): "The mac is now one of the most secure platforms with regards to this specific attack vector."

Re: MacOS FileVault2 Password Retrieval

#70

Post by gist »

baby wrote: post #42
6DM wrote: post #29

Earlier quoted context omitted.

I was curious about that, so I looked it up. Pretty interesting stuff. [0] "On the afternoon of October 1, 2013, officers watched as Ulbricht entered the library and made his way up the stairs to work by the window at a desk in the science fiction section, Kiernan recalled. Meanwhile, sitting on a bench outside of the library, homeland security officer Jared Der-Yeghiayan — who had been working undercover as Silk Roa…

If they made a movie about Snowden, they will surely made a movie about this.

American Greed episode on Silk Road:

http://www.cnbc.com/live-tv/american-greed/full-episode/silk...

Post reply on HN