#1626: AirTag replacement battery gotcha, Kindle Kids software flaws, iOS 12.5.6 security fix.#1627: iPhone 14 lineup, Apple Watch SE/Series 8/Ultra, new AirPods Pro, iOS 16 and watchOS 9 released, Steve Jobs Archive.#1628: iPhone 14 impressions, Dark Sky end-of-life, tales from Rogue Amoeba.

#1629: iOS 16.0.2, customizing the iOS 16 Lock Screen, iPhone wallet cases, meditate for free with Oak.Watch the video below to see it in action.

The reboot switches off the DMA protections, but the password is still present in memory for a few seconds – long enough for the device to search for, and retrieve, it. The password is put in multiple memory locations – which all seems to move around between reboots, but within a fixed memory range. The second issue is that the the FileVault password is stored in clear text in memory and that it’s not automatically scrubbed from memory once the disk is unlocked. Once macOS is started it will enable DMA protections by default. macOS resides on the encrypted disk – which must be unlocked before it can be started. EFI which is running at this early stage enables Thunderbolt allowing malicious devices to read and write memory.

The first issue is that the mac does not protect itself against Direct Memory Access (DMA) attacks before macOS is started. He reports that the vulnerability is no longer present in macOS 10.12.2, and has now explained exactly how it worked. Just stroll up to a locked mac, plug in the Thunderbolt device, force a reboot (ctrl+cmd+power) and wait for the password to be displayed in less than 30 seconds!įrisk notified Apple back in August, when the company confirmed the issue and asked him to withhold details pending a fix. If the Mac is sleeping, it is still vulnerable. Security researcher Ulf Frisk has shared details of a vulnerability in macOS 10.12.1 and lower that allowed anyone with physical access to a locked Mac to quickly and easily obtain the password simply by plugging in a $300 Thunderbolt device.Īnyone including, but not limited to, your colleagues, the police, the evil maid and the thief will have full access to your data as long as they can gain physical access – unless the Mac is completely shut down.

Mac os 10.12 review