Bug in macOS High Sierra Exposes Passwords of Encrypted APFS Volumes in Plain Text

[DrMacintosh]

Quote

Matheus Mariano appears to have discovered a significant Disk Utility bug that exposes the passwords of encrypted Apple File System volumes in plain text on macOS High Sierra. 

Quote

The issue currently only affects Macs with SSD storage due to Apple File System compatibility, but APFS will eventually support machines with Fusion Drives as well. Schwarz believes users who haven't specified a password hint, or haven't used Disk Utility whatsoever, are probably not affected. 

So apparently there is a slight bug in the Disk Utility app in High Sierra that if the proper steps are taken, can result in your password to be shown as a plain text file if you had the "hint" option enabled on your Mac. Apparently as long as your don't have that hint feature enabled you are fine. 

 

I guess this is affects people who leave their machines out for a while for people to try to get into them and It could also affect alone who simply gets their machine stolen and have not disabled the password hint at the login screen. 

 

It would seem that while I have had good experiences so far with macOS High Sierra that some users are reporting some bugs and now with this I guess there are some legitimate issues with the OS (just like any software release ever) 

 

I feel like Apple loosened the reins on its developers for this season of software releases. iOS 11 is a mess and a small number of older Mac users are having issues with High Sierra. I don't like it when macOS isn't "just working" since thats why I got a 2016 MacBook Pro. I need that reliability. Now there is this that needs to be patched. Luckily its a bug in this app and not something deeper that would require a while to fix. A patch should be out soon (probably a few days) if I know Apple. 

 

Source: https://www.macrumors.com/2017/10/05/macos-high-sierra-disk-utility-vulnerability/

[vanished]

I'm reminded of that bug in windows where you could get help from the login screen and ask for a command line and then open one and so on

[flibberdipper]

incoming Apple haters seizing the opportunity to become pigeons and shit all over them

[DrMacintosh]

Just now, Ryan_Vickers said:

you could get help from the login screen and ask for a command line and then open one

Jesus

[DrMacintosh]

Just now, tmcclelland455 said:

incoming Apple haters seizing the opportunity to become pigeons and shit all over them

I'm an Apple Sheep (to some degree) but that facts are the facts. 

[Zodiark1593]

Even Apple developers and QA are merely humans, prone to errors and such.

 

[sazrocks]

Don't you already have to have the password to exploit this though?

[flibberdipper]

Just now, DrMacintosh said:

I'm an Apple Sheep (to some degree) but that facts are the facts. 

I'm an Apple sheep but honestly only for the build quality of the MBP and the OS which it runs.

 

and the fact that Apple knows how to make sexy ass hardware

[mr moose]

1 minute ago, tmcclelland455 said:

incoming Apple haters seizing the opportunity to become pigeons and shit all over them

but they deserve it, clearly this is proof they are a shit company and don't know what they are doing.

[DrMacintosh]

Just now, sazrocks said:

Don't you already have to have the password to exploit this though?

I just report the articles 

[DrMacintosh]

Just now, mr moose said:

clearly this is proof they are a shit company and don't know what they are doing.

Clearly

 

(remembers that Windows 10 S is a thing) 

[vanished]

1 minute ago, mr moose said:

but they deserve it, clearly this is proof they are a shit company and don't know what they are doing.

I mean, that seems like a bit of an extrapolation.  If this is all it takes then literally every company and product ever falls under that definition.

[Ryujin2003]

Does any of this really matter? Last time I knew, it is easier to reset/remove a Mac OS login password than it is to do the same thing through CMD on Windows....

 

So, if I really wanted to log into a Mac, I could do that. And thankfully, no one I've met has used the same login password that they also use for iTunes... So luckily have that separation... Maybe if they did a thing like Windows where the password cannot be manipulated if it's tied to a cloud account....

[NoRomanBatmansAllowed]

Yay Apple!

 

This might be fun to pentest.

[flibberdipper]

2 minutes ago, mr moose said:

but they deserve it, clearly this is proof they are a shit company and don't know what they are doing.

And yet Microsoft somehow decided an ARM-based tablet running "Windows" was a good idea, same with Windows 10 S...

 

Or go back to the 90's when Cyrix made a decent P5 competitor and used a 486-era FPU which killed the chip in some applications and was really the beginning of the end for them.

 

Or how about AMD relying on a CPU which wasn't a whole lot better than its predecessor for so long that it was hilarious?

 

Every company pulls a Dumbo and trips up.

[vanished]

I think the ghost of this problem will hang over them for a while though, especially as a company that presents themselves as a very secure option.  This kind of thing is not the sort of thing you want to happen.

[DrMacintosh]

2 minutes ago, Ryan_Vickers said:

I think the ghost of this problem will hang over them for a while though, especially as a company that presents themselves as a very secure option.  This kind of thing is not the sort of thing you want to happen.

I doubt that. Companies have done way worse and nobody remembers those misplays anymore. 

 

It will be patched and everyone will forget. Especially since this bug isn’t really the end of the world. It affects a sub group of a sub group of a sub group. 

[vanished]

1 minute ago, DrMacintosh said:

I doubt that. Companies have done way worse and nobody remembers those misplays anymore. 

 

It will be patched and everyone will forget. Especially since this bug isn’t really the end of the world. 

I guess it depends how much press it gets.  Consumers can be scared by thing easily, and the scare level often correlates more with the amount of press than the actual severity.

[mr moose]

14 minutes ago, Ryan_Vickers said:

I mean, that seems like a bit of an extrapolation.  If this is all it takes then literally every company and product ever falls under that definition.

Not all mistakes are equally,  apple do them because they are dumb,  everyone else just got bad advice or were held to an unfair contract.

 

8 minutes ago, tmcclelland455 said:

And yet Microsoft somehow decided an ARM-based tablet running "Windows" was a good idea, same with Windows 10 S...

 

Or go back to the 90's when Cyrix made a decent P5 competitor and used a 486-era FPU which killed the chip in some applications and was really the beginning of the end for them.

 

Or how about AMD relying on a CPU which wasn't a whole lot better than its predecessor for so long that it was hilarious?

 

Every company pulls a Dumbo and trips up.

 

Except that the difference is that apple are derr brains and you would know about all the other stuff if the apple fanboys didn't go looking for it to post all over the Internet. 

 

 

 

[DrMacintosh]

3 minutes ago, mr moose said:

Not all mistakes are equally,  apple do them because they are dumb, 

So much sass in one post. 

 

Everything A does is by defnieition bad but if B does the same thing it’s ok.

[vanished]

2 minutes ago, mr moose said:

Not all mistakes are equally,  apple do them because they are dumb,

I think the truth is their best engineers have actually moved over to the mobile division and so their desktop OS is lacking... Level1Techs have mentioned this numerous times in the past when there have been other stories of issues with MacOS

[DrMacintosh]

1 minute ago, Ryan_Vickers said:

their best engineers have actually moved over to the mobile division

That’s where their money is. macOS is great but it’s not the money maker. 

[Sniperfox47]

32 minutes ago, Ryan_Vickers said:

I'm reminded of that bug in windows where you could get help from the login screen and ask for a command line and then open one and so on

Or the bug in the Linux kernel that let you drop into a Grub2 rescue shell by hitting backspace 28 times

[captain_to_fire]

28 minutes ago, mr moose said:

but they deserve it, clearly this is proof they are a shit company and don't know what they are doing.

Hmm... 

 

 https://www.bleepingcomputer.com/news/security/new-illusion-gap-attack-bypasses-windows-defender-scans/ 

 

I could go on... 

[vanished]

2 minutes ago, hey_yo_ said:

I could go on... 

and on and on and on...

Spoiler

 

But really