EDGE 2015 is starting in

Find out more EDGE 2015
Menu
Apple engineering mistake exposes clear-text passwords for Lion

Apple engineering mistake exposes clear-text passwords for Lion

An attacker could potentially decrypt information secured with an older version of FileVault, Apple's encryption technology

Apple's latest update to OS X contains a dangerous programming error that reveals the passwords for material stored in the first version of FileVault, the company's encryption technology, a software consultant said.

David I. Emery wrote on Cryptome that a debugging switch inadvertently left on in the current release of Lion, version 10.7.3, records in clear text the password needed to open the folder encrypted by the older version of FileVault.

Users who are vulnerable are those who upgraded to Lion but are using the older version of FileVault. The debug switch will record the Lion passwords for anyone who has logged in since the upgrade to version 10.7.3, released in early February.

"This is what the secure FileVault partition was supposed to protect against after all," Emery said in an interview.

Apple has two versions of FileVault. The first version allowed a user to encrypt the contents of the home folder using the Advanced Encryption Standard (AES) with 128-bit keys. An upgraded product, FileVault 2, which shipped with OS X Lion, encrypts the entire content of the hard drive.

When someone upgrades to Lion but still uses the first version of FileVault, the encrypted home folder is migrated, which is now vulnerable with this security issue. Emery wrote that the password is accessible to anyone with root or administrator access, he wrote. But what is worse is that passwords can also be read another way.

Emery described that passwords can also be read by "booting the machine into FireWire disk mode and reading it by opening the drive as a disk or by booting the new-with-Lion recovery partition and using the available superuser shell to mount the main file system partition and read the file."

"This would allow someone to break into encrypted partitions on machines they did not have any idea of any login passwords for," he wrote.

There are a couple ways to mitigate the problem. Emery wrote that the FireWire disk and recovery partition attack can be headed off by using FileVault 2. An attacker would have to know at least one password before a file could be accessed on the main partition of the disk, he wrote.

Also, a firmware password could be set that would be needed in order to boot the recovery partition, external media or even enter the FireWire disk mode. Emery cautioned though that Apple "Genius Bar" employees know a standard technique to turn it off.

The issue highlights the fragility of technology, Emery said. "A mistake like this exposes more or less the keys to the kingdom to someone with literally no access to a supposedly secured area on a machine, and maybe nothing more than chance physical access to a target's laptop for a few unguarded minutes," he said.

The bug has probably been around since the release of 10.7.3, Emery wrote. Emery said he wasn't the first to find the problem, and that other people discovered it several weeks before he did and reported it to Apple.

"One wonders why such a debug switch exists in shipped production code," Emery wrote. "Clearly it could be invoked covertly in specific situations. This seems to be an example of someone turning it on for the entire release by accident."

Apple did not have an immediate comment.

Send news tips and comments to jeremy_kirk@idg.com

EDGE 2015:: For all the latest on EDGE 2015 including the keynote speakers visit the EDGE mini-site now

Follow Us

Join the ARN newsletter!

Error: Please check your email address.

Upcoming

Slideshows

In Pictures: Robots that cook, clean, sing and dance
Tech Hive

In Pictures: Robots that cook, clean, sing and dance

Cooking, learning language and doing the laundry are a few of the human skills demonstrated by.real humanoid bots featured in the National Geographic movie Robots.

In Pictures: Robots that cook, clean, sing and dance
IN PICTURES: OKI Data Australia partner event (+10 photos)
Business Products

IN PICTURES: OKI Data Australia partner event (+10 photos)

OKI recently hosted its ChannelOne dealer forum for its executive series channel partners to get together and learn about the company's new high-performance ES8400 A3 multifunction series printers. After a welcome and business overview from OKI Data Australia managing director, Dennie Kawahara, delegates were given a comprehensive overview of the new product, as well as an update on the latest marketing initiatives and software solutions, before being treated to live demos and a product showcase. Partners were also given a preview of OKI’s upcoming A3 digital LED white toner printer. With more than 60 delegates attending from all over the country, the day concluded with dinner at Casa Ristorante Italiano in Sydney and several delegates also participated in a friendly game of golf the following morning.

IN PICTURES: OKI Data Australia partner event (+10 photos)

iasset.com is a channel management ecosystem that automates all major aspects of the entire sales, marketing and service process, including data tracking, integrated learning, knowledge management and product lifecycle management.

Show Comments