High Sierra vulnerability exposes the password of an encrypted APFS container

Posted by cimnine on Thursday October 05, 2017 @07:21AM
from the medium.com dept.

https://medium.com/@matheusmariano/new-macos-high-sierra-vulnerability-exposes-the-password-of-an-encrypted-apfs-container-b4f2f5326e79

( 10 comments | 36 points | on HN )

Re:High Sierra vulnerability exposes the password of an encr... by jmdocherty on Thursday October 05, 2017 @09:54AM (#15409119)

Glass half-full: "Oops! They missed this because they were busy making all the other stuff super-secure."

Glass half-empty: "Oh-my-goodness...what would Steve say? FFS. We can't trust anyone any more!"

I'm inclined to be half-full.

[ Parent | on HN ]

Re:High Sierra vulnerability exposes the password of an encr... by tinus_hn on Thursday October 05, 2017 @10:40AM (#15409525)

Glass completely empty: why is the system storing your password when the volume is not mounted so it can be revealed by the dialog?

[ Parent | on HN ]

Re:High Sierra vulnerability exposes the password of an encr... by psychometry on Thursday October 05, 2017 @11:01AM (#15409702)

Someone probably just mixed up the hash keys for the password field and the hint field. The hint needs to be stored unencrypted so that it can be displayed.

[ Parent | on HN ]

Re:High Sierra vulnerability exposes the password of an encr... by _jn on Thursday October 05, 2017 @11:31AM (#15409978)

Agree. It's probably an issue with the form, nothing underlying. (which means encrypted containers created via the command line should be safe from this vulnerability?)

[ Parent | on HN ]

Re:High Sierra vulnerability exposes the password of an encr... by jchw on Thursday October 05, 2017 @07:26AM (#15408281)

So... it stores the password as a password hint?

One must wonder how Apple's QA process didn't catch something as egregious as that in a piece of security code.

[ Parent | on HN ]

Re:High Sierra vulnerability exposes the password of an encr... by natch on Thursday October 05, 2017 @11:14AM (#15409823)

Probably some unthinking tester was just using the same string in both fields (e.g. “test”). As a developer I’ve learned over the years not to do that. That tester should have their work attitude adjusted and their methods thoroughly reviewed.

[ Parent | on HN ]

Re:High Sierra vulnerability exposes the password of an encr... by headShrinker on Thursday October 05, 2017 @11:36AM (#15410006)

There’s probably some easy explanation but why is there a need separate code to store variables for the ssd vs hdd version? I would think this would be high level code, abstracted far away from any hardware differences

[ Parent | on HN ]

Re:High Sierra vulnerability exposes the password of an encr... by jsjohnst on Thursday October 05, 2017 @12:09PM (#15410285)

I believe the SSD vs HDD issue is not about the password hint codepath, but rather that APFS is only supported on SSDs right now.

[ Parent | on HN ]

Re:High Sierra vulnerability exposes the password of an encr... by jaclaz on Thursday October 05, 2017 @02:35PM (#15411486)

It is now officially acknowledged by Apple (though they don't seem like treating it as a bug):

https://news.ycombinator.com/item?id=15410953

https://support.apple.com/en-us/HT208168

[ Parent | on HN ]

Re:High Sierra vulnerability exposes the password of an encr... by runesoerensen on Thursday October 05, 2017 @12:37PM (#15410526)

"Creating a volume via diskutil, the hint, not the pw is shown. Looks like the root cause is Disk Utility storing the password as hint."

https://twitter.com/felix_schwarz/status/915857500330700801

[ Parent | on HN ]