News, info, and opinion by Mac users, for Mac users.

February 29, 2008

security

Security glitch reveals OS X password

Posted Feb. 29, ’08, 12:35 PM PT by David Dahlquist
Category | Security

apple lock.jpgIf you’re buddies with any malicious cyber geeks or hackers, think twice before letting them hop on your Mac—A security glitch that exposes the OS X password of a Mac to someone with physical access to it has been confirmed by Apple. Oops.

The vulnerability, discovered by San Francisco-area programmer Jacob Appelbaum, arises out of a programming error that keeps the account password in the Mac’s memory long after it’s needed, allowing it to be retrieved and used to log into the computer by unsavory types.

“This is a real problem and it needs to be fixed,” said Appelbaum, who reported the issue to Apple. Apparently, Apple’s response was far from stellar: “They won’t put it in the latest security update or release a security update just for this issue.”

I don’t grant physical access to my Mac to many people, and the ones who do use it every so often wouldn’t have the know-how or intent to take my password. Nevertheless, this is still a big deal; Your OS X password should never be at risk of being compromised. I hope as this story circulates, Apple will be pressured to address this issue with haste.

[Via boingboing]


6 Comments

Dave-O said:

Sounds like a HUGE problem in a lab environment.

February 29, 2008 1:15 PM
James Bailey said:

It sounds more dire than it really is. The memory is protected. For software alone to retrieve the password you need admin access. The problem is that you can also reach the memory with DMA access but that requires someone plug in a hardware device with special software on it. That is not a common scenario. Apple needs to fix this but it isn't currently a large risk.

February 29, 2008 3:23 PM
Kelmon said:

I think it's worth linking to the original article and crediting News.com with this one:

http://www.news.com/8301-10784_3-9881870-7.html

What this should demonstrate is that the instructions on how to achieve this is very much in the open now and therefore this is a hole that needs to be fixed ASAP.

Given this and the other exploit recently exposed for breaking into FileVault by extracting the DRAM chips from the computer, hardware manufacturers should start looking at ways to erase the contents of memory as part of the shutdown process.

March 1, 2008 7:27 AM
Khürt Williams Author Profile Page said:

This is a huge issue as most new Mac users run with the default account they created when they started their Mac for the first time. That account does have Administrator rights. Also, when users take their Mac to be serviced they are often asked for the Administrator account password. Do you really trust a Mac "genius" with your Mac in the back room?

This is a security issue that needs to be addressed NOW!

Mac users are way too lax ( and smug ) when it comes to computer security.

March 1, 2008 11:23 AM
James Bailey said:

Who is being smug? I said that Apple needs to fix it but the hand wringing is over done. It is not that large of a risk. So someone who you give admin rights to on your computer can get admin rights on your computer?

Shut down your computer and wait 20 minutes before when handing it over to be serviced. Problem solved.

Just having a login with admin rights is not enough to read the memory with software alone. You need the password so you can get root.

I would never take security issues lightly but I also inform myself on the details. This one is not a big deal for most users. If that sounds smug to you, so be it.

March 1, 2008 11:49 AM
Kelmon said:

@James Bailey

I'm not sure if there is a misunderstanding here but the exploit allows someone to obtain your user account name and password using only another computer and an ethernet cable but does also require the target computer to be turned on or asleep. The job takes only a couple of minutes to do and most of that can be done "off-line" as you look through the memory dump to find the account name and password.

For the servicing of the computer you are entirely correct that you should shutdown the computer completely in advance of handing it over. However, I am more concerned about this exploit in the context of an office or other "open" environment with many people and where you often walk away from your computer while it is still on. The requirement for physical access means this is not going to be a major issue but it is clear that if someone wanted access to your computer's data they can get it pretty easily.

March 2, 2008 3:19 AM

Leave a comment

 



Visit other IDG sites: