OS X Lion update accidentally outs user passwords in plain text

Stefan Mileschin · 7th May 2012, 07:57

Are you an avid user of OS X's FileVault encryption and running a recently updated version of Lion? It may be time to consider changing your passwords. According to security researcher David Emry, users who used FileVault prior to upgrading to 10.7.3 may be able to find their password in a system-wide debug log file, stored in plain text outside of the encrypted area. This puts the password at risk of being read by other users or enterprising cyber criminals, Emry explains, and even opens the door for new flaw-specific malware. FileVault 2, on the other hand, seems to be unaffected by the bug. The community doesn't currently have a way to fight the flaw without disabling FileVault, so users rushing to change their password now may find it being logged as well. Obviously, we'll let you all know once we hear back from Apple regarding this matter.

http://www.engadget.com/2012/05/06/o...in-plain-text/

7th May 2012, 07:57	#1
Stefan Mileschin [M] Reviewer Join Date: May 2010 Location: Romania Posts: 148,618	OS X Lion update accidentally outs user passwords in plain text Are you an avid user of OS X's FileVault encryption and running a recently updated version of Lion? It may be time to consider changing your passwords. According to security researcher David Emry, users who used FileVault prior to upgrading to 10.7.3 may be able to find their password in a system-wide debug log file, stored in plain text outside of the encrypted area. This puts the password at risk of being read by other users or enterprising cyber criminals, Emry explains, and even opens the door for new flaw-specific malware. FileVault 2, on the other hand, seems to be unaffected by the bug. The community doesn't currently have a way to fight the flaw without disabling FileVault, so users rushing to change their password now may find it being logged as well. Obviously, we'll let you all know once we hear back from Apple regarding this matter. http://www.engadget.com/2012/05/06/o...in-plain-text/

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
EFI Update Brings Lion Recovery to iMacs	Stefan Mileschin	WebNews	0	28th October 2011 06:52
Recover that Photo, Picture or File You Deleted Accidentally	jmke	WebNews	0	22nd April 2010 15:16
How To Hide Expensive Cooling Gear From Your Spouse In Plain Sight	jmke	WebNews	1	18th February 2010 13:06
Create a Shortcut to the Stored User Names and Passwords Dialog in Windows	jmke	WebNews	2	1st August 2008 08:31
GeForce 8600 GTS & GT; Plain Outside But Lethal Inside	thorgal	WebNews	0	15th March 2007 10:18
EU to tax e-mail, text messages?	Sidney	WebNews	5	28th May 2006 10:50
Difference between user and power user	lazybones	Hardware/Software Problems, Bugs	4	28th November 2002 13:11