Slashdot Mirror
macOS High Sierra Logs Encryption Passwords in Plaintext for APFS External Drives (bleepingcomputer.com)
Catalin Cimpanu, writing for BleepingComputer: macOS High Sierra users are once again impacted by a major APFS bug after two other major vulnerabilities affected Apple's new filesystem format in the last five months. This time around, according to a report from Mac forensics expert Sarah Edwards, recent versions of macOS High Sierra are logging encryption passwords for APFS-formatted external drives in plaintext, and storing this information in non-volatile (on-disk) log files.
The issue, if exploited, could allow an attacker easy access to the encryption password of encrypted APFS external volumes, such as USB thumb drives, portable hard drives, and other external storage mediums. This bug goes against all well-established Apple development and security rules, according to which apps and utilities should use the Keychain app to store valuable information, and should definitely avoid storing passwords in cleartext. Video 1, and 2.
The issue, if exploited, could allow an attacker easy access to the encryption password of encrypted APFS external volumes, such as USB thumb drives, portable hard drives, and other external storage mediums. This bug goes against all well-established Apple development and security rules, according to which apps and utilities should use the Keychain app to store valuable information, and should definitely avoid storing passwords in cleartext. Video 1, and 2.
Will a security update shred the logs? I wonder how they're going to fix this.
Apple is really having the most childish bugs in the last few years?
And where is my new Mac Pro tower?
---- The above post was generated by the Turing Institute. Maybe.
Apple copied stupid command line Linux and that's why they have all of these bugs! If they copied Windows instead, at least we'd be able to play games!
How do these security experts find this bugs, but Apple overlooks them so easily?
I'm a drunk that's been fired a few times for sexual harassment and spent time in jail for corporate espionage. But I promise you I won't write your supra sekrit keyz to a log file in plaintext.
FFS.
Good for Apple for doing that. It might come in handy if someone wants a password for something. Disclaimer: I do not own any Apple products.
Incase you forget your password, you can find it again so you don't lose your encrypted data!
I used to joke that all the good coders have left Apple... but maybe it's not a joke after all.
#DeleteChrome
Jesus Christ Apple! What is it that hard. Don't log passwords. Any of them. Never.
It's been a bad day for Apple on Slashdot...
You know how you shouldn't judge a book by its cover? That goes doubly for deciding that because something LOOKS good, that means it probably is. Take everything Apple makes, for example. Very slick-looking products, that turn out to be complete crap with built-in planned obsolescence, designed to cost you a bunch of money up front, a bunch of money to maintain and use, buying proprietary accessories since Apple's idea of "leadership" is to try to find the best way to play nicely with the rest of their industry, then do the exact opposite!!! Then once you're hooked into their goddamned ecosystem, they try to compel you to stay by making sure none of their shit works with anything made by anyone else, which isn't just so it will "work," (for example, USB devices that Apple HAD to adopt because they were simply too popular, but they REFUSE to switch to the inexpensive, superior, and ubiquitous MicroUSB, instead insisting on their own, custom, proprietary "Lightning" bullshit just to oblige you to buy their overpriced cables and accessories, which in turn will help encourage you, when your iPhone or iPad or iPod or iPud or iPuke dies, to replace it with another that works with their accessories. BUT then rather than spend the fortune their stupid users fork over to them (as they have in years passed,) making an at-least halfway-decent product, they now spend it building fancy headquarters buildings, paying their executives obscene pay and benefits, and treating you like the moron you are for buying their shit. The worst thing anyone can do to you is to try to rope you into using something from Apple. Someone gives you an iPop or iPutz or whatever, that person is NOT your friend. Just saying.
The result here, then, is Apple pushing beta-quality software (if EVEN beta-quality, something with glaring security holes really deserves an alpha designation; it's NOT ready for prime-time,) as if it's a finished product, like something that lets you do stuff as "root" without needing a password, or that you can unlock with a lifted fingerprint, or that lets you execute arbitrary code on their devices, because quality control got outsourced to... the past. They don't do it anymore, apparently, and the result is increasingly expensive, slick-looking shit that you'd be a fool to use, let alone pay good money for. Anyone buying anything from Apple after this deserves what the fuck they get... which is basically a pile of apple-themed shit.
How can anyone that is concerned about security use this crap?
Apple + goto fail.
Duck Duck Go it.
Exactly! Case in point, bluetooth. It is an open standard and should work across devices regardless of brand or model, yet Apple just locks in all their devices to block other non-Apple products from connecting via Bluetooth!!! What a lame move. Encouraging more e-waste.