Fixed in 10.13.2 - but wow, was High Sierra ever a sloppy release.
Sloppy and marketed as a stability build. There were hardly any new features in it.
Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes
11–20 of 123 posts
Re: Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes
#12Even the UI issues Apple has now are appalling let alone bugs they don’t even seem to know how to consistently have a lock button across devices for example. If the basics are poorly thought through, how is something like security going to be done properly?
Re: Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes
#13Please don't link to mac4n6, it serves malware on some page loads. The article author is aware of it but apparently doesn't have the ability to fix the issue
After doing a quick sweep of the network and processes, I didn't find anything overtly malicious (unless you count 6 MB pages for a blog, 150k lines for squarespace's JS, and 3000 rules over 400KB).
Re: Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes
#14That's pretty bad. It's been known for decades on other Unix systems that you shouldn't pass passwords by command line parameter, or even support doing so. I guess no-one told Apple.
[deleted]
Re: Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes
#15Please don't link to mac4n6, it serves malware on some page loads. The article author is aware of it but apparently doesn't have the ability to fix the issue
What kind of malware did you run into?
It was a malware dropper masquerading as a Firefox update. I hit it when I visited this page a few days ago and so did someone else.
Re: Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes
#16This isn't the first time they've logged passwords. Back around 2014, I found that they were dumping apple id passwords into one of the log files for iBooks (CVE-2014-1317). It was dumping the request body in hex for a redirected login request.
Re: Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes
#17Please don't link to mac4n6, it serves malware on some page loads. The article author is aware of it but apparently doesn't have the ability to fix the issue
Not calling you out but I'd like to see a source for this. A quick web search for mac4n6 malware didn't turn up anything.
Source: Me, and at least one other person on twitter after I mentioned it there.
Re: Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes
#18Please don't link to mac4n6, it serves malware on some page loads. The article author is aware of it but apparently doesn't have the ability to fix the issue
After doing a quick sweep of the network and processes, I didn't find anything overtly malicious (unless you count 6 MB pages for a blog, 150k lines for squarespace's JS, and 3000 rules over 400KB).
When I last examined it, the malware was loading from a domain called eventsbysteph. If the page still pulls js from there then the malware's still around (doesn't activate on 100% of loads)
Re: Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes
#19That's pretty bad. It's been known for decades on other Unix systems that you shouldn't pass passwords by command line parameter, or even support doing so. I guess no-one told Apple.
Exactly. More to the point, even if it doesn't log it any more, I bet it's still on the command line itself.
The usual trick here is to pass it as an environment variable instead of cmdline, that can be done without much effort so they're probably doing that.
Re: Logs in High Sierra Show Plaintext Password for APFS Encrypted External Volumes
#20Please don't link to mac4n6, it serves malware on some page loads. The article author is aware of it but apparently doesn't have the ability to fix the issue
Not calling you out but I'd like to see a source for this. A quick web search for mac4n6 malware didn't turn up anything.
Here is the source — https://twitter.com/iamevltwin/status/976627634066132992