If you are still using macOS 10.13(.0), update to 10.13.3 right away.Now that the news is out, Apple will probably address this soon, but until then here is what you can do to protect your encrypted volumes:
Password for sierra mac password#
Log files are included, so now your plaintext password was sent to Apple. If you’ve ever had a support call with Apple, you may have been walked through installing an information collection app this app is used to scrape all sorts of data from your Mac, and it sends it to Apple for analysis so they can help you resolve your issue. Why is this a big deal? Well, passwords stored in plaintext can be discovered by anyone with unauthorized access to your machine, and malware can collect log files as well and send them off to someone with malicious intent. Newly created APFS volumes can be encrypted without the password showing in the logs. If an APFS volume was created back then, and a 10.13.3 user decides to encrypt it now, the new bug will rear its head and store the password in plaintext. Existing APFS volumes may be vulnerable, because of the earlier mentioned bug that showed a password in the password hint window.Īpple’s fix was to erase the encrypted volume and recreate it. With the help of other Twitter users, Sarah Edwards found that the bug is still present in the current version of High Sierra 10.13.3! While partially patched in earlier versions of High Sierra, if an existing APFS volume is encrypted in 10.13.3, the password will be stored in plaintext in the logs. Now, of course, I would not be writing about this if there wasn’t a catch.
Password for sierra mac install#
If this specific bug fix was not mentioned by Apple, it surfaces an important question: What other bugs and vulnerabilities may have been addressed by Apple in the past that we’re not aware of? This goes to show it’s always a good idea to install the latest updates as soon as possible, because they may very well include fixes to bugs and vulnerabilities that Apple does not tell you about. This bug was likely a result of other APFS encryption related bugs (or at least somehow related to it), so perhaps Apple felt it didn’t need to provide the additional details. In the case of this bug, Apple addressed it in High Sierra version 10.13.1, but made no mention of it in their security release notes. Image credit: Sarah Edwards at Īpple always publishes security notes after system updates are released, which we inform our readers of on The Mac Security Blog, but Apple’s notes typically do not list every issue.
0 kommentar(er)
