Feeds

Apple logging passwords in plain text

Lion debug ‘feature’ breaks security

Website security in corporate America

A post to Cryptome is pointing the finger at Apple for logging plain-text passwords of users of “legacy” Filevault under Lion 10.7.3.

According to David Emery, the February update of Lion turned on a debug switch which, as a result, logs in plain text the password of a user of an encrypted directory tree. “Thus anyone who can read files accessible to group admin can discover the login passwords of any users of legacy (pre LION) Filevault home directories who have logged in since the upgrade to 10.7.3 in early February 2012,” the post notes.

It’s not the first time this logging behavior has been spotted, but only with the Cryptome post has it strayed beyond one post to Apple and a thread on Novell’s forums wondering what’s going on.

Emery says the log is accessible via a number of approaches, including opening the machine’s drive in Firewire disk mode, or booting via the recovery partition.

One of the Novell thread posters suggests symlinking /var/logs/secure.log to /dev/null to kill the logging.

While the passwords are only locally available, Emery notes that the logging breaks the "family security" model in which different users of the same machine are kept away from each others' files. ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.