Apple security blunder exposes Lion login passwords in clear text

http://www.zdnet.com/blog/security/apple-security-blunder-exposes-lion-login-passwords-in-clear-text/11963

by Empro • 14 years ago

240 109 14 years ago

joshmlewis• 14 years ago

So are there literally security researchers that go and poke around of every release of everything major in the software industry to find things like this?

amalter• 14 years ago

Yes, they are called "hackers" .. Especially the black hat kind.

stcredzero• 14 years ago

> There literally security researchers that go and poke around of every release of everything [snip] in the software industry to find things like this

Fixed.

ams61102• 14 years ago

There are. It's the main reason why "security through obscurity" isn't a good idea. There are people who spend their working days searching for this kind of stuff. Log files are probably one of the first places they would look for clues.

skeletonjelly• 14 years ago

`grep password` isn't the hardest thing to do either

toemetoch• 14 years ago

It's actually a very lucrative business if you keep the security bugs secret and sell them on the market. Google "Vupen" for an example.

greedo• 14 years ago

Yep. Some are white hats hoping to either make money or reputation by discovering flaws. Don't think that these flaws don't get discovered; sometimes pentest experts discover flaws and keep them in their arsenal for a particularly difficult assessment. Other times, it's a blackhat who discovers them and sells them in the underground world. If you want to experience a jolt, visit www.exploitdb.com and search for vulnerabilities in your favorite software. And be sure that for every exploit listed, there are a few that are kept hush hush.

Xuzz• 14 years ago

Note: only applies to people using the old "FileVault" on Lion, not the new "FileVault2" (the one with full-disk encryption).

sliverstorm4• 14 years ago

Go on, let's hear about how devoted Apple is to security again.

ams61102• 14 years ago

Seems more like a QA problem to me, there should be some tests in the QA of a final release build that makes sure all the debug flags are turned off.

eblume• 14 years ago

Yeah, that seems like a no-brainer to me. Even my company's small 2-person software 2-person QA team has a release test to make sure all debug parameters are shut off. The software won't even run if a debug parameter is on without some special shim that only us devs have.

sliverstorm4• 14 years ago

That's my point. "Security" is a complete package, that includes good QA.

DanBC2• 14 years ago

It's a bit worrying that people noticed this 3 months ago, and there have been no fixes.

DenisM• 14 years ago

You could have made the same point in a less inflammatory way. Next time, please do.

sliverstorm4• 14 years ago

Apologies. Sometimes it just seems I can only catch the attention of the zealots with something a little inflammatory.

greghinch• 14 years ago

While I agree that this is a security hole and it should be fixed, a headline like that is completely misleading and a scare tactic to drive eyeballs to the article. This flaw only would affect a very small subset of users, but the headline makes it sound like everyone just had their passwords compromised

sakopov• 14 years ago

What I got out of the article seems to be more important than the number of users this could impact.

1. A vital piece of the operating system was compiled with debug flags intact. 2. Apple's lack of response on the issue.

I think this goes hand-in-hand with recent Kaspersky statement about Apple's poor security considerations.

bilbo0s• 14 years ago

Those are definitely the two 'take-aways'. If there is a hole here... there may be other holes that might be REAL security threats.

Other people are correct as well, in that the headline is link bait. I was expecting to find a way to get clear text passwords from my test OSX Lion setup. I can't actually do that on my test system, and I'd wager the vast majority of hackers can't pull that off either. At least not without changing the setup.

Of course... probably my fault for believing you could.

eridius2• 14 years ago

2. Apple's lack of response on the issue.

The takeaway I got was that nobody actually tried to contact Apple's various security contacts and instead just posted on forums.

tptacek17• 14 years ago

I can't name a single person who ever used "Legacy Filevault"; that's the "encrypt your home directory" thing from Leopard. This issue doesn't impact Lion FDE at all. Lots of people use Lion FDE.

Even the subhed on this story is misleading, and the lede paragraph seems to go out of its way to bury the true article lede, which is "if you're using FileVault home directory encryption, this impacts you" --- instead, it says "in specific configurations".

More generally: can anyone name a single case where ZDNet has broken a story we cared about? Even in this case, ZDNet is rehashing stuff published elsewhere earlier.

Tloewald• 14 years ago

I don't know about breaking stories anyone cares about, but sometimes they post stories I find interesting, just never about Apple

mrich3• 14 years ago

I find it interesting how Apple is defended when they make security blunders, while Microsoft was heavily slammed back in the day.

It is simply inacceptable that a user basically reported the issue on their support forum and didn't even get an answer back.

joejohnson• 14 years ago

The parent comment isn't defending Apple; @tptacek is pointing out that this issue won't impact a large number of users, that the headline is misleading, and that maybe ZDNet is sensationalizing a minor issue.

w1ntermute2• 14 years ago

> I find it interesting how Apple is defended when they make security blunders, while Microsoft was heavily slammed back in the day.

Given that we have a plurality of OS X users on HN (according to the last poll), it's not surprising that post-purchase rationalization is a common response to such articles.

kevinchen• 14 years ago

mrich, no company's engineers can be expected to spend their days reading every single thread on the company's support forum. I wonder if the researcher(s) reported the issue using Apple's Bug Reporter? It has a special category for Security.

hej3• 14 years ago

This comment doesn’t defend Apple. It doesn’t make any value judgments about Apple at all. It merely attacks the article.

tptacek17• 14 years ago

Every single time the topic of Microsoft's security track record has come up on HN, I've waded in to point out what a great job Microsoft has done. Here's one of my highest rated comments from several years ago:

http://news.ycombinator.com/item?id=577684

Now, I don't disagree with your general point: Microsoft gets more scrutiny than Apple does on HN about security, and Apple enjoys an inflated perception of platform security here --- I attribute that to a general Unix bias, by the way, and not to Apple fandom.

But please be careful to note that I'm not a part of that phenomenon. You will, if you dig, find comments of mine that are critical of Apple security; you will probably not find comments critical of Microsoft's security practices.

(To be clear: securing a whole platform is an incredibly difficult job, and platform software security talent is some of the hardest to find in the whole industry; both Apple and Microsoft take this stuff seriously and, compared to 2002, both do a fantastic job. Also: the security of the iOS platform is a different story than of the OS X platform.)

rickmb• 14 years ago

"Back in the day", Microsoft didn't make security blunders. It made things fundamentally insecure as a matter of policy, and could get away with it because they had a virtual monopoly.

This significant difference informs how people respond, regardless of the nature of the blunder.

ben1040• 14 years ago

>I can't name a single person who ever used "Legacy Filevault"; that's the "encrypt your home directory" thing from Leopard.

I tried it a few times. The saying "fool me once, shame on you, fool me twice, shame on me" hit home for me the second or third time I had to waste time cleaning up a corrupted home directory.

The Lion version seems to work great.

stickfigure• 14 years ago

Eh? I used it.

I used "Legacy Filevault" before it was legacy. Then, when I upgraded to Lion, it took some additional months for me to get around to the FDE upgrade. I had to move around a lot of data to make room.

I consider this a pretty big deal.

tptacek17• 14 years ago

You're the one person I know, now. Most everyone I knew that cared to encrypt their laptops (to be clear: that includes my whole team) used PGP WDE. My impression of legacy "homedir" Filevault is that it randomly ate homedirs.

bodyfour3• 14 years ago

I'm in the same boat; been using FileVault since day one.

I just checked and, sure enough, my cleartext password is visible if I run:

  $ sudo cat /var/log/asl/* | strings | grep 'password ='

So if my laptop were lost or stolen not only would the encryption be worthless, but my login password is available too. This is a big hole.

Guess today's a good day to switch to FDE

sohn• 14 years ago

You are a brainless fanboy.

tptacek17• 14 years ago

It's funny that this got voted back up from light grey. One might have a morbid interest in the list of people who cast such votes.

Sanddancer2• 14 years ago

This is more than just Filevault. This is /any/ user mount of an AFP share, so things like shared user directories, which are common in large organizations, are also vulnerable. The issue here is that this security vulnerability exists, 3 months after it was publicly reported. Surely it wouldn't take that long to release a patch for a pretty critical vulnerability.

tptacek17• 14 years ago

So that's a good point, but I feel compelled to point out that I've never seen a large organization with AFP shared user directories.

There are far more important vulnerabilities --- clientside drive-by remote code execution, for instance --- that have gone unpatched for longer than this. Do I think 3 months is a reasonable time-to-fix? No comment.

eridius2• 14 years ago

What do you mean? I just mounted an AFP share and my password did not end up in the syslog.

huggyface2• 14 years ago

Story involves Apple - Overblown, not a threat, everyone is dumb, anyone reporting it is a moron, etc.

Story involving anyone else - Critical fault of enormous consequence demonstrating profound incompetence, anyone not reporting it is a moron, etc.

I'm sorry, Mr. Ptacek, but the other poster who calling you a "fanboy" is perhaps onto something: You needn't have even made a post because everyone could have predicted with certainty exactly what you were bound to say.

tptacek17• 14 years ago

User 'sohn managed to say the same thing in far fewer words downthread.

othermaciej2• 14 years ago

That doesn't accurately reflect tptacek's posting history at all. I've seen him defend Microsoft's security practices and for that matter the TSA's security practices, often when others are saying there is a critical fault of enormous consequence. While his views may be a little more pro-establishment than most folks here, I've never seen him act specifically pro-Apple. I think you should read his comment history and then consider apologizing.

Osiris• 14 years ago

But it does appear to affect anyone that does NOT use full disk encryption. If I were to venture to guess, I would estimate that the vast majority of Mac OS Lion customers do not use full disk encryption.

For those that do, you're lucky. For everyone else, this is horrible.

I agree with the comments that if this type of issue was found in a Microsoft product, I suspect there would have been a patch issued in less than a month and probably much sooner. Is Apple just sticking is head in the sand or do they just hope that no one notices the problem while they (slowly) work on getting a fix into a future release?

Or is it that having to do a special patch for this means that Apple has to admit that they have security issues like Microsoft has had to deal with? I'd love to know the reasoning at Apple about why this wasn't fixed as soon as they found out about it.

fishtoaster• 14 years ago

Are you saying that this affects anyone not using filevault? If so, I think you are mistaken- looking at the original post(http://cryptome.org/2012/05/apple-filevault-hole.htm), it appears to be only those using filevault on Lion, and of those, only the people using the legacy mode thereof.

biafra• 14 years ago

Is the password written to disk if I am not using FileVault or FileVault2 in Lion?

Even then, I would not want my password be written to disk. This would be a serious problem for me.

brudgers2• 14 years ago

>"This issue doesn't impact Lion FDE at all. Lots of people use Lion FDE."

Wouldn't it be the case that if a person used the same password for full disk encryption that has been exposed by the security flaw, that Lion FDE security would be compromised?

In other words, this seems to be a case where an isolated software flaw creates the potential to exploit a common wetware security flaw.

The claim the ZDnet appears to be making is that this flaw is most likely to make its appearance felt in environments with lots of Macs and a need for backwards compatibility or flexible support for employees with Mac laptops.

It looks to me like the risk is to any ecosystem which supports heterogeneous OSX configurations - e.g. the VP of Sales Macbook may be an attack vector due to the way in which he uses it at home.

millzlane• 14 years ago

Steve called, he said "Just don't use it that way".

On a serious note, this has happened before. This is just the first time anyone has caught it before a patch. The QA at Apple is pretty noteworthy.

thespin2• 14 years ago

I thought FireWire was being phased out. (Doubtfully due to security considerations. If I recall, Intel has something faster that uses a USB port.)

I have some older hardware, which was state of the art when I bought it, that uses FW.

Is FW going to go the way of PCMCIA and CardBus?

Zr402• 14 years ago

Most current Macs have a Thunderbolt port, which is quite fast. I don't doubt that USB 3 ports will start to appear in the coming years, too.

bodyfour3• 14 years ago

"Target mode" also works with Thunderbolt. In fact it used to work with SCSI as well; it far predates OS/X as a feature on Macs. It doesn't work over USB though.

The stuff in the article about Firewire mode being involved is really a red herring. You would have the same problem if your stolen laptop were opened up and the harddrive removed. Firewire target mode is just a less-invasive way of doing the same thing.

0x0• 14 years ago

BTW, another curious part of firewire (unrelated to target mode) is that a firewire device can read and write RAM from a running PC, without interaction. Even when you have "locked the workstation". Random google link: http://www.hermann-uwe.de/blog/physical-memory-attacks-via-f...

zobzu3• 14 years ago

Original link: (not zdnet)

http://cryptome.org/2012/05/apple-filevault-hole.htm

vectorpush• 14 years ago

Only slightly related, but this thread bears a striking resemblance to another HN exploit discussion:

http://news.ycombinator.com/item?id=3925452

The exact same back and forth:

Wow! This is really bad... but it only affects a small subset of users... but they knew about it for months and didn't fix it... come on, nobody real actually uses such a setup... what about me... you're all fanboys, this is just another example of how your religion doesn't hold security as a core tenant among its faithful.

remixhacker• 14 years ago

the Console Message Inspector is pretty useful, it shows a lot of stuff that is normally hidden.

robomartin2• 14 years ago

Does anyone else thing that it is slimy for ZDNet interpret clicks to the site background as the user clicking the ad below the nav-bar?

As an advertiser I would feel defrauded. Not one person clicking on the background is doing so out of interest in the advertiser's product.

How common is this practice?

sp3322• 14 years ago

I'm definitely not seeing that behavior. There was a pop-over ad that I had to skip though. I guess if that were malfunctioning / transparent, you wouldn't realize there was an ad frame hovering over the text?

robomartin2• 14 years ago

Perhaps I wasn't clear. It's not the white background, it's the patterned background to the right and left of the content area. To be more precise, they have two div's with class "skinClick" setup on the right and left of the "content" div. You click on either one of those and it's the same as having clicked on the ad just below the nav-bar.

I tested in Safari, Firefox, IE and Chrome, same behavior. There's also the "Wait, your page is loading" popup ad you mentioned.

Apple security blunder exposes Lion login passwords in clear text

Related Stories