Apple file system flaw, macOS shows encrypted drive’s password in the hint box

Pierluigi Paganini October 06, 2017

Apple released a patch for macOS High Sierra 10.13 that address also a flaw in Apple file system that exposes encrypted drive’s password in the hint box.

Apple yesterday released a security patch for macOS High Sierra 10.13 to fix vulnerabilities in the Apple file system (APFS) volumes and Keychain software.

The vulnerability in the Apple file system was first reported by Matheus Mariano, a developer at Leet Tech,  and later confirmed also by the programmer Felix Schwartz.

The vulnerability in the Apple file system tracked as CVE-2017-7149 could be exploited by a local attacker to gain access to an encrypted APFS volume.

“If a hint was set in Disk Utility when creating an APFS encrypted volume, the password was stored as the hint. This was addressed by clearing hint storage if the hint was the password, and by improving the logic for storing hints.” reads the description provided by Apple on its support website.

When users create an encrypted APFS volume on a Mac with an SSD using Apple’s Disk Utility app and set up a password hint, invoking the password hint mechanism while remounting the volume will display the current password in plaintext.

Apple file system flaw

Here’s a video demonstrating the programming cockup:

Another flaw fixed by Apple tracked as CVE-2017-7150 affects the Keychain and was discovered by the popular expert Patrick Wardle. Wardle revealed that unsigned applications can steal macOS Keychain passwords from the latest version of macOS High Sierra and previous versions of macOS.

Many developers questioned the quality of macOS High Sierra 10.13 released at the end of September.

[adrotate banner=”9″] [adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs – Apple file system, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]

you might also like

leave a comment