Sign in
  • About
    • About Us
    • Writers
  • Visit Us On YouTube
  • Advertise With Us
  • Contact
    • Apply
    • Contact Us
    • Guest Post
Sign in
Welcome!Log into your account
Forgot your password?
Password recovery
Recover your password
Search
  • Sign in / Join
Sign in
Welcome! Log into your account
Forgot your password? Get help
Password recovery
Recover your password
A password will be e-mailed to you.
  • About
    • About Us
    • Writers
  • Visit Us On YouTube
  • Advertise With Us
  • Contact
    • Apply
    • Contact Us
    • Guest Post
Home Security Mac OSX Security Hole Leaves Lion’s Login Info in Clear Text
  • Security

Mac OSX Security Hole Leaves Lion’s Login Info in Clear Text [UPDATE]

By
Kevin Che
-
May 9, 2012
0
1084
Facebook
Twitter
Pinterest
WhatsApp

    Looks like Apple has another problem with security and the safety of their operating system. Apple’s latest update of Lion, Mac OS 10.7.3, has accidentally turned on a system-wide debug log that logs all of the login credentials, including passwords, since the update to 10.7.3 and logs the passwords in plain clear text. Users that have used Apple’s FileVault service prior to updating to Lion, but kept the folders encrypted using the legacy version of FileVault are vulnerable (FileVault 2 users are unaffected). Anyone who has administrative access or root access has seen the users credentials of the encrypted home directory, or from a Time Machine backup, or even from a FireWire connected hard drive. Also, since someone can access the user credentials to the account, they can access anything meant to be protected by the user credentials.

    The flaw was first reported by the security researcher, David Emery. He posted the findings to the Cryptome mailing list, saying…

    …anyone who can read files accessible to group admin can discover the login passwords of any users of legacy (pre LION) Filevault home directories who have logged in since the upgrade to 10.7.3 in early February 2012.

    This is worse than it seems, since the log in question can also be read by booting the machine into firewire disk mode and reading it by opening the drive as a disk or by booting the new-with-LION recovery partition and using the available superuser shell to mount the main file system partition and read the file. This would allow someone to break into encrypted partitions on machines they did not have any idea of any login passwords for.

    David Emery has said the best way to prevent some malicious user to have access to their credentials is to enable full disk encryption with FileVault 2, saying “which then requires one know at least one user login password before one can access files on the main partition of the disk.” Lets just ope that Apple will patch the hole soon.

    UPDATE: The Mac OSX 10.7.4 update fixes the security hole

    Related

    Comments

    • TAGS
    • Apple
    • Lion
    • Login
    • mac
    • OSX
    • password
    Facebook
    Twitter
    Pinterest
    WhatsApp
      Previous articleGoogle+ Live Hangout with Mike Kane of Cell Helmet TODAY [LIVE]
      Next articleEvernote Clearly for Google Chrome [REVIEW]
      Kevin Che

      RELATED ARTICLESMORE FROM AUTHOR

      How To Protect Yourself If Your Credit Card Is Stolen

      Turkey Blocks Facebook, Twitter, and YouTube… AGAIN

      The Importance of Backups (3-2-1 Backup Rule)

      EDITOR PICKS

      POPULAR POSTS

      How to Create a Windows 7 Embedded Flash Drive

      Dec 17, 2012

      How To Record Your iPhone Screen

      Jun 22, 2012

      How To Make The Boxee Box Useful Again

      Sep 27, 2013

      POPULAR CATEGORY

      • Video674
      • Tech531
      • Business250
      • Hardware191
      • Tech Link Daily190
      • Software126
      • Entertainment126
      • Development100
      • Gaming98
      ABOUT US
      FOLLOW US
      • About
        • About Us
        • Writers
      • Visit Us On YouTube
      • Advertise With Us
      • Contact
        • Apply
        • Contact Us
        • Guest Post
      ©