Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MacOS FileVault2 Password Retrieval

blog.frizk.net

Post reply on HN
Print view View original

81–90 of 90 posts

Re: MacOS FileVault2 Password Retrieval

#81

Post by bburky »

dashesyan wrote: post #54

I've had this in my .profile for years: alias sleepsafe='sudo pmset -a destroyfvkeyonstandby 1 hibernatemode 25' alias sleepfast='sudo pmset -a hibernatemode 0' alias sleepdefault='sudo pmset -a hibernatemode 3' Whenever I travel or need to leave my laptop, I always run `sleepsafe`, which will delete the key from memory and hibernate the computer when I close the lid. It has the added benefit of saving battery life.…

I prefer YoNTMA: https://github.com/iSECPartners/yontma-mac

If the laptop is disconnected from AC, it hibernates. It will switch to hibernate if power is removed while already sleeping. If I want to force a hibernate manually, I just pull the power before closing the lid.

Re: MacOS FileVault2 Password Retrieval

#82

Post by pier25 »

nicolas_t wrote: post #3

Has Apple released patches for El Capitan? I'm still using it instead of Sierra because of Karabiner but this could force me to upgrade. That vulnerability seems to be a pretty obvious oversight. I remember hearing about DMA (in the context of Firewire) as an attack vector since people first started talking of Truecrypt and Filevault and scrubbing the memory seems obvious... It's worrying that this could have been ov…

Apparently this fix is only available for Sierra 10.12.2

A nice big finger from Apple to those of us that won't upgrade.

Re: MacOS FileVault2 Password Retrieval

#83

Post by RainCloud »

renaudg wrote: post #79
kennell wrote: post #73

Earlier quoted context omitted.

What encryption are you using? I was under the impression that FV2 (or any other full disk encryption solution) does not work on a Hackintosh

It unfortunately doesn't work on the boot volume of a Hackintosh, but pretty sure it does on other volumes.

Actually, there have been recent development on this.[1] I'm not brave enough to try it though.

[1] http://www.insanelymac.com/forum/topic/317290-filevault-2/

Re: MacOS FileVault2 Password Retrieval

#84

Post by gdavisson »

jakobegger wrote: post #74
emptybits wrote: post #69

Good on Apple for "completely" fixing this, according to the authors. But am I wrong to wish for more plain-English acknowledgement of the problem and reassurance in Apple's 10.12.2 release notes? i.e. https://support.apple.com/en-ca/HT207423 Anyways, at this point in time it's nice to read (from the authors of the exploit): "The mac is now one of the most secure platforms with regards to this specific attack vector.…

I read through the release notes, and I didn't see any mention of this issue at all. The fix must have been a EFI firmware update (my Mac did restart multiple times during the update, so this sounds plausible), but nothing is mentioned about this anywhere.

I saw the firmware-update progress bar (one of several similar progress bars that macOS/OS X can show during startup) during a 10.12.2 update. So that's a bit more confirmation...

Re: MacOS FileVault2 Password Retrieval

#85

Post by M4v3R »

nicolas_t wrote: post #3

Has Apple released patches for El Capitan? I'm still using it instead of Sierra because of Karabiner but this could force me to upgrade. That vulnerability seems to be a pretty obvious oversight. I remember hearing about DMA (in the context of Firewire) as an attack vector since people first started talking of Truecrypt and Filevault and scrubbing the memory seems obvious... It's worrying that this could have been ov…

To be fair, it seems that all OS vendors overlooked this:

https://www.youtube.com/watch?v=fXthwl6ShOg

Re: MacOS FileVault2 Password Retrieval

#86

Post by shshhdhs »

dashesyan wrote: post #63
j_s wrote: post #56

Earlier quoted context omitted.

Thanks for sharing these awesome shortcuts! Are there any caveats that I should be aware of before just stealing this to use for myself?

Just make sure you eject any removable disks before hibernating. And, sleepfast may drain your battery faster than the default hybrid sleep

OP said sleepfast increases his battery life. It sounds like you lose whatever is in memory though

Re: MacOS FileVault2 Password Retrieval

#87

Post by KirinDave »

kennell wrote: post #73
KirinDave wrote: post #34

Good hack, good on Apple for getting fixes out. But what worries me somewhat is that the tools for mitigation for these families of attacks include a lot of technologies that are traditionally opposed by the community here on the grounds that it "takes away control from the user. I'm not sure how we balance out those tensions, but attacks like this sure as heck concern me about my homebuilt machine. I do my best not…

What encryption are you using? I was under the impression that FV2 (or any other full disk encryption solution) does not work on a Hackintosh

Why would FV2 protect me from DMA attacks on machines that are essentially self built off the shelf parts?

Hint: it probably won't.

Re: MacOS FileVault2 Password Retrieval

#88

Post by teddyh »

renaudg wrote: post #78
teddyh wrote: post #9

Earlier quoted context omitted.

Even though the computer may be “locked”, if the OS is running and accessing the disk, it means that the key is present somewhere in memory. There are various methods of accessing this key, the fallback brute-force method being the ( https://en.wikipedia.org/wiki/Cold_boot_attack ). The method from the article only removes the need to physically remove and cool the memory chips.

There are no memory chips to remove on recent Macs, making this attack much harder if not impossible to perform.

Macs still have memory chips, even if they are not removable. This can be attacked by using specialized hardware which you press onto the RAM chips’ connectors. The inability to remove RAM is not meant as a security feature, and therefore gives no significant protection against a motivated attacker with specialized hardware.

Re: MacOS FileVault2 Password Retrieval

#89

Post by DINKDINK »

genesee wrote: post #66
dogma1138 wrote: post #51

Earlier quoted context omitted.

A screen saver (w/ require password & possible full hibernation with memory flush)?

That's defeated by a USB mouse jiggler [1], which is apparently commonly used by the type of people who seize computers in the wild. [1] https://www.amazon.com/CRU-Inc-30200-0100-0011-WiebeTech-Jig...

Yes, my idea was a intension counter measure to 'mouse' jigglers.

Re: MacOS FileVault2 Password Retrieval

#90

Post by kennell »

RainCloud wrote: post #83
renaudg wrote: post #79

Earlier quoted context omitted.

It unfortunately doesn't work on the boot volume of a Hackintosh, but pretty sure it does on other volumes.

Actually, there have been recent development on this.[1] I'm not brave enough to try it though. [1] http://www.insanelymac.com/forum/topic/317290-filevault-2/

Sweet, thanks for the link, will give it a try after i got everything backed up :)
Post reply on HN