Re:MacOS FileVault2 Password Retrieval
by teddyh on Friday December 16, 2016 @09:36AM
(#13193463)
Even though the computer may be “locked”, if the OS is running and accessing the disk, it means that the key is present somewhere in memory. There are various methods of accessing this key, the fallback brute-force method being the (https://en.wikipedia.org/wiki/Cold_boot_attack). The method from the article only removes the need to physically remove and cool the memory chips.
[ Parent
| on HN ]
There are no memory chips to remove on recent Macs, making this attack much harder if not impossible to perform.
Macs still have memory chips, even if they are not removable. This can be attacked by using specialized hardware which you press onto the RAM chips’ connectors. The inability to remove RAM is not meant as a security feature, and therefore gives no significant protection against a motivated attacker with specialized hardware.
Ok, I thought that Apple would scrub all keys from memory when the computer goes to sleep so that a computer that's asleep would not be vulnerable to the Cold Boot Attack. Seems strange they don't do that? Or would it make waking up too slow?
My understanding is that it is configurable on macOS by enabling destroyfvkeyonstandby.
https://derflounder.wordpress.com/2014/02/12/power-nap-power...
Apple wants the computer to be able to wake up on its own in order to fetch new emails and such. Just a few minutes ago, I used Screen Sharing to connect to my sleeping MacBook from another room to check for updates based on this article's recommendation. Quite convenient, but it does imply that the OS keeps the keys around.
I'd bet that if you turn all that stuff off, they keys are scrubbed. That could be a good compromise instead of turning the computer completely off all the time.
Re:MacOS FileVault2 Password Retrieval
by raverbashing on Friday December 16, 2016 @12:49PM
(#13195150)
Sleep does not shuts down ram.