FileVault 2 Easily Decrypted

Infinite redirect chain on my mobile phone.

It's not really scanning memory, that's just their marketers trying to spin some razzlemadazzle for the plebes.

It's using Firewire Target Disk mode to get raw access to the disk. Apple stores its admin passwords using the highly obsolete MD5 algorithm, which is easily cracked in most cases using rainbow tables generated using the seed that is stored in plain text. It's pretty simply and I have personally broke into my own File Vault partitions after forgetting the password. You don't even need to spent $995, it's trivial to do with almost no skills. Anyone can do it themselves, which should convince them that File Vault is useless and its CPU load a pointless price to pay for zero security gain. This has all been dead obvious from day one too, the cited article is not even news, it's an advertisement for a company selling junk to clueless law enforcement incapable of doing basic research.

edit: OK, I'm wrong on some technical details:

1. Apple uses SHA-1 hashing not MD5.

2. I either need admin access in any account to access the /private/var/db/dslocal/nodes/Default/users/ folder and pull the plist with the hash from the account I am interested in, or I need to boot in Firewire mode which allows raw disk access to the unencrypted partition with that folder. (I haven't paid $995 for the referenced program but that would seem possible that's what it is really doing, not reading memory through FireWire looking for the plaintext password stored in the open in memory, which is also possible: http://www.hermann-uwe.de/blog/physical-memory-attacks-via-f... - this also helpfully notes that "sudo kextunload /System/Library/Extensions/IOFireWireFamily.kext/Contents/PlugIns/AppleFWOHCI.kext" deletes the relevant kernel extension to kill FW - I happen to already have this removed for other reasons.)

Still just as vulnerable to rainbow tables, but shoot maybe it does scan memory.

The thunderbolt port have DMA access also, so I suppose the technique applies as well.

It should be mentioned that in the past the University of Princeton had successfully extracted encryption keys from a cold booted computer after the PC has been completely turned off.

They even demonstrate what they had recovered and how many bits has been lost.

Check this page and videos: https://citp.princeton.edu/research/memory/ https://citp.princeton.edu/research/memory/media/

I use suspend-to-disk which suspends to my encryped swap partition. No need to "shut down" your computer, just don't use suspend-to-ram.