News for hackers. Stuff that matters.

A comment on Apple removes first-party firewall exemption in macOS 11.2 beta 2. Parent comment

Re:Apple removes first-party firewall exemption in macOS 11.... by SamuelAdams on Thursday January 14, 2021 @08:46AM (#25776174)
> (the OS volume itself isn't encrypted and is read-only, the data volume is encrypted with your password)

Wait, WHAT? Can someone with an M1 encrypted volume Mac check this directory and see if you see thumbnails?

> $TMPDIR/../C/com.apple.QuickLook.thumbnailcache/

A full writeup of this is at the link [1]. This has been a well-known thing in computer forensics for many years, which is why *full* disk encryption is so important.

[1]: https://objective-see.com/blog/blog_0x30.html

[ Parent | on HN ]
Re:Apple removes first-party firewall exemption in macOS 11.... by my123 on Thursday January 14, 2021 @09:34AM (#25776711)
Everything in the Data volume is encrypted. The System volume is signed by Apple and is the same on every Big Sur Mac (SSV feature).

This can be disabled through csrutil though.

[ Parent | on HN ]
Re:Apple removes first-party firewall exemption in macOS 11.... by BillinghamJ on Thursday January 14, 2021 @10:09AM (#25777163)
The OS volume is a read-only image now - just system files only, and is signed etc
[ Parent | on HN ]
Re:Apple removes first-party firewall exemption in macOS 11.... by wil421 on Thursday January 14, 2021 @09:24AM (#25776573)
No such file or directory on my M1 Air.
[ Parent | on HN ]