macOS High Sierra Logs Encryption Passwords in Plaintext for APFS External Drives (bleepingcomputer.com) 62
Catalin Cimpanu, writing for BleepingComputer: macOS High Sierra users are once again impacted by a major APFS bug after two other major vulnerabilities affected Apple's new filesystem format in the last five months. This time around, according to a report from Mac forensics expert Sarah Edwards, recent versions of macOS High Sierra are logging encryption passwords for APFS-formatted external drives in plaintext, and storing this information in non-volatile (on-disk) log files.
The issue, if exploited, could allow an attacker easy access to the encryption password of encrypted APFS external volumes, such as USB thumb drives, portable hard drives, and other external storage mediums. This bug goes against all well-established Apple development and security rules, according to which apps and utilities should use the Keychain app to store valuable information, and should definitely avoid storing passwords in cleartext. Video 1, and 2.
The issue, if exploited, could allow an attacker easy access to the encryption password of encrypted APFS external volumes, such as USB thumb drives, portable hard drives, and other external storage mediums. This bug goes against all well-established Apple development and security rules, according to which apps and utilities should use the Keychain app to store valuable information, and should definitely avoid storing passwords in cleartext. Video 1, and 2.
How to update? (Score:3)
Will a security update shred the logs? I wonder how they're going to fix this.
Re:How to update? (Score:5, Informative)
It was already fixed in 10.13.2 released December 2017. The person that reported the problem was using the original High Sierra release 10.13.0. She had other people tell her it was fixed in 10.13.2 and 10.13.3.
Shit for brains runs deep here at Slashdot.
Re: (Score:1)
The built quality of macs is good, let's not get extreme. Over priced, it depends on the mac (and whether or not you're entitled to discounts), awful software, indeed. But they're actually good computers to install arch in them :o)
Does this seem only to me or... (Score:2)
Re: (Score:1)
The entire company is having quality control issues. Even the marketing department.
Apple fixes buggy iPhone X ad before fixing the actual iOS 11 bug
https://www.theverge.com/2018/3/23/17155756/apple-ios-11-bug-iphone-x-ad [theverge.com]
Re: (Score:1)
Don't look now, but the real obsessive is the one making numbered lists on Slashdot.
Re: (Score:1)
I have actively avoided being diagnosed. It's an important freedom that more people should exercise.
It's LINUX's fault. (Score:3, Funny)
Apple copied stupid command line Linux and that's why they have all of these bugs! If they copied Windows instead, at least we'd be able to play games!
Re: (Score:1)
Re: (Score:2)
a descent gaming OS.
Oh, sorry, I meant decent.
Re: (Score:1)
Courageous bugs!
FTFY
Re: Does this seem only to me or... (Score:1)
Huh?
SMB never worked in 10.4 properly in 10.3-10.4 config files often got corrupt,iPod nanos screens often cracked, antennagate, the touchpad on the last gen of powerbooks,mighty mouse right click, power cables which always break,minor updates constantly breaking audio drivers back in the days.
Seriously, QA has always been really bad. The only difference is that people ignored the issues back then. That's only a short list.
Re: (Score:1)
What's worse is the the overall stability and reliability of macOS has gone down hill. I have to reboot or recover from hung core processes or even the window server about once a week now. I used to go weeks, sometimes months, between reboots, not any more.
I agree quality has gone downhill since Jobs' death, but it went downhill somewhat prior to that as well. iOS 9 and 10.7 were both under Jobs and were the start of GCD. While GCD solves a specific problem, converting the entire OS to it has proven to be a great source for all sorts of bugs. Even so I'm running multiple 10.10-10.12 systems and they're nice and stable for months. Not sure what you're doing, but even running multiple VMs hasn't affected the stability at all.
Re: (Score:2, Interesting)
Features like this ensure the security services can work in real time on all big brand US products.
Junk crypto in the hands of trusting users has been the NSA's pathway to winning for decades.
Re: (Score:3)
Re: (Score:2)
Apple is being like Microsoft and many other companies. Really bad or worse lack of QA. :(
High Sierra - It just doesn't work (Score:4, Insightful)
And where is my new Mac Pro tower?
Re: (Score:2)
My Quadra 650 is the desktop version, but you can stand it on end and pretend it's the minitower version.
Re: (Score:2)
And where is my new Mac Pro tower?
Apple said "Modular". They never said "Tower".
Re: Security Experts (Score:2)
Security experts have the job of breaking things. Most other people have deliverables, so iterative QA misses this. The ideal situation is having your own internal team trying to break any product when ever they please. Maybe Apple already has a security team dâ(TM)oà g exactly this?
Apple, please hire me (Score:5, Funny)
FFS.
Good idea! (Score:2)
It's a feature (Score:3)
Incase you forget your password, you can find it again so you don't lose your encrypted data!
Good grief, Apple (Score:2)
I used to joke that all the good coders have left Apple... but maybe it's not a joke after all.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)