Slashdot Mirror
macOS Breaks Your OpSec by Caching Data From Encrypted Hard Drives (bleepingcomputer.com)
Apple's macOS surreptitiously creates and caches thumbnails for images and other file types stored on password-protected / encrypted containers (hard drives, partitions), according to macOS security experts Wojciech Regula and Patrick Wardle. From a report: The problem is that these cached thumbnails are stored on non-encrypted hard drives, in a known location and can be easily retrieved by malware or forensics tools, revealing some of the content stored on encrypted containers. On macOS, these thumbnails are created by Finder and QuickLook. Finder is the default macOS file explorer app, similar to Windows Explorer. Whenever a user navigates to a new folder, Finder automatically loads icons for the files located in those folders. For images, these icons are gradually replaced by thumbnails that show a preview of the image at a small scale.
Unless, of course, your system drive is encrypted. Which is one of the first suggestions macOS will give you when you boot your mac for the first time. If you are worried about this kind of thins chances are your system drive will be encrypted and this chache stuff won't be a problem at all.
Well... Windows creates them on the drive itself. But I thought that was what MacOS was doing as well so I could be totally off on that.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
The difference is you can find out exactly what a Linux file manager does, while how MacOS works is a proprietary trade secret.
But RedHad sqandered that advantage with systemd and Gnome 3
> these cached thumbnails are stored on non- ... content stored on
> encrypted hard drives,
> encrypted containers.
This does not make sense. If the hard drives are encrypted by FileVault; the storage location for these thumbnails would be encrypted too. Where else is this cache supposed to live? I'm pretty sure that Apple does not add an extra, secret, non-encrypted drive to everyone's Macs so as to cache these silly little images. And as if the summary weren't bad enough, it gets worse when you read the article. QuickLook isn't new, as they claim. It was introduced as part of Leopard, more than a decade ago. And a quick check on my CLI shows that TEMPDIR is very much part of my encrypted root volume. I'm thinking these people are not the "macOS security experts" they claim to be; and msmash failed as an editor in not properly vetting the article he chose to post.
Imagine all the people...
To make the GUI look nice and have the GUI be more responsive sooner the OS has a nice easy way to show the thumbnails on file the user looks over in their encrypted external drive.
More at the linked "Cache Me Outside" AC.
https://objective-see.com/blog...
Domestic spying is now "Benign Information Gathering"
The reason to use encryption is so that other people don't know what's in files. Keeping aspects of whats encrypted in the open on an OS gets around what file encryption should support.
Used by forensics experts for some time, would it not be a place for governments and government created malware to look too?
Encryption becomes a joke.
Domestic spying is now "Benign Information Gathering"
This amounts to copying data from one device to another without the user knowing. This is just plain bad design and you are being an Apple apologist.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
> these cached thumbnails are stored on non- ... content stored on
> encrypted hard drives,
> encrypted containers.
This does not make sense. If the hard drives are encrypted by FileVault; the storage location for these thumbnails would be encrypted too. Where else is this cache supposed to live? I'm pretty sure that Apple does not add an extra, secret, non-encrypted drive to everyone's Macs so as to cache these silly little images. And as if the summary weren't bad enough, it gets worse when you read the article. QuickLook isn't new, as they claim. It was introduced as part of Leopard, more than a decade ago. And a quick check on my CLI shows that TEMPDIR is very much part of my encrypted root volume. I'm thinking these people are not the "macOS security experts" they claim to be; and msmash failed as an editor in not properly vetting the article he chose to post.
I guess the issue is when you have your laptop drive not encrypted and you connect an encrypted USB-stick on it. It then creates thumbnails of what's on your USB stick and store them on your unencrypted system drive.
No need to be an expert. Common sense is enough.
Write boring code, not shiny code!
I'm pretty sure users have to wait a whole second for the thumbnails to be generated if the Thumbs.db file cannot be written to the media.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
I can understand the security concern about thumbnail data especially encrypted data. But for other systems with the feature Including Windows and Some Linux file managers, Do they handle it differently?
On Windows it uses thumbs.db, a hidden system file located in each folder that has thumbnails cached (not all do if they don't contain documents or images that get preview thumbsnails). You can also turn thumbnail caching off in explorer settings or via group policy.
I browse on +1 so AC's need not respond, I won't see it.
Windows creates the thumbnails in a subdirectory of the original, so it should also be encrypted (or maybe it doesn't anymore.) And I believe the index is per drive. At any rate, there is a checkbox for "turn off thumbnails" and "turn off indexing" on a drive.
Your ad here. Ask me how!
So someone who doesn't know how their computer works and said 'no' to encrypting their system drive doesn't have a right to benefit from security if someone gives them an encrypted drive to use? Honestly, I know about computers and I wouldn't have thought of this. I know I don't have anything on my system drive that I need encrypted, but I do know how to make an encrypted flash drive and do use them occasionally. I never would have thought of this.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
But that is true for anything. If you plug in an encrypted drive in an insecure system and decrypt it, the encryption doesn't matter. Your memory could be swapped to disk at any point in time regardless of your OS. Hence the need for FDE.
Custom electronics and digital signage for your business: www.evcircuits.com
Which has nothing to do with this. The thumbnails are not created by the kernel but by the Finder, which is not open source.
All I want is a secure system where it's easy to do anything I want. Is that too much to ask ~~ Randall Munroe
~/.cache/thumbnails -> /dev/null
One of APFS's features is allowing for multiple keys per volume. What Apple should have done is store the cache data, but keyed to both the encrypted volume being used, as well as the system volume. This way, if there is no system volume encryption, things are protected still. If there is, it would require two keys to get to the caching info.
Hopefully this can be fixed. Apple comes up with some great stuff, but then misses the mark with other places.
Linux does not cache things on disk. The only risk is swap, which you just encrypt at boot with a new, random key every boot.
Applications may do something else though.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
All modern filesystems (HPFS+, NTFS, ext4) support metadata. The issue isn't with the filesystems, it's with the tools and apps built on top. Most importantly, each FS has its own way of reading/writing metadata, so no cross platform tools can readily take advantage.
Chrome stubbornly takes webpage screenshots and uses them as thumbnails for the websites I visit, including but not limited to my private NAS (which can display file names) and my banking website (which can display very sensitive data).
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
So do Konqueror, Dolphin, and Thunar.
To ~/.thumbnails