Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Situation: Filevault 2 passwords can be stolen

Passware has released the Passware Kit Forensic 11.3 which is able to steal the FileVault 2 password from the RAM by performing a DMA Attack via the FireWire port.

They state that their software:

  • recovers Mac User Login passwords and FileVault keys from computer memory and
  • decrypts TrueCrypt and FileVault volumes in minutes.

Various suggestions have been made trying to describe how to protect a Mac with Filevault 2 from such an attack:

sudo pmset -a destroyfvkeyonstandby 1 hibernatemode 25

This will remove the full volume encryption key from RAM when the system is put into sleep mode and forces the system to immediately write RAM to disk and remove power from memory upon sleep.

Question:

What user behavior is necessary and what steps does one have to take for maximum protection with FileVault 2 on the Mac?

share|improve this question
    
N.B. inception (github link) is able to perform DMA attacks on a variety of targets (OS X, Windows and Linux), so you don't need the Passware software for that. –  Tim Jan 19 '13 at 21:15

2 Answers 2

Your question contains the most important thing needed to secure a computer against a motivated attack to compromise a FileVault 2 protected Mac volume.

  1. Don't connect FireWire to a device you don't or can't trust while you are logged in to an account that has file vault keys active.
  2. Pick good single use passwords to reduce the chance of other compromises degrading the security of your FileVault password.
  3. Update to 10.7.3 and verify sudo pmset -a destroyfvkeyonstandby 1 hibernatemode 25 power management settings that force hibernate mode to secure your keys from compromise when the device would normally "sleep"

I do follow Rich Trouton to keep up to date on his blog for nice commentary on securing macs. The mix of up to date topics seasoned with experience as a real world system administrator make his writing very valuable to me.

The crux of the issue is your parsing What user behavior is necessary to have security. I always like to think of security as a mindset and ongoing attempt to plan, implement, measure and adapt. Security isn't something you buy or something you "set up" and training users to actually not divulge the passcode they have used to store their unlock phrase is the weakest part of FileVault's security layer. Not reusing that passcode - having a system where you get your users to understand why their keychain password needs to be unique and secure is far, far harder and takes far longer than just setting up a plan for implementing file vault initially. Best of luck in your quest for security!

share|improve this answer
2  
In addition, don't just reply on technological measures to protect you. Anything that you can do to increase the security through configuration and the like can be attacked. This attack vector isn't new, isn't unique to Filevault, and also isn't actually particularly practical given that it requires, first and foremost above all other things, physical access to your machine while it is turned on. If you are worried about it, then never use sleep, never use hibernate. Choose a long password (monkeyrhubarbcatsunglasses is better than hjsa£1KJh4$) and turn it off when not in use. –  stuffe Feb 6 '12 at 21:27
    
Thank you for your answer bmike! Security as a mindset - that's very true. I'd say that you cover most of my concerns. I was hoping that maybe something else would be popping up in an answer that I did not know of until now. Apparently, there is nothing more to say :) Thanks! –  gentmatt Mar 30 '12 at 6:59
    
@stuffe The strength of passwords just by length is disputed, which is why I have both a complex and long password. You might be interested in this question on security.stackexchange: Short complex password, or long dictionary passphrase? –  gentmatt Mar 30 '12 at 7:03
    
Does this vulnerability apply if the machine has locked the screen before sleeping? The chart here suggests that screen-locked machines are safe, does that not apply to a sleeping machine? Also, this suggests that simply enabling setting a firmware password solves the problem. –  raxacoricofallapatorius Aug 17 '12 at 17:56

Could someone steal your machine? Besides preventing electronic access, you'd need to keep it under lock & key.

Seriously, at each step, you get the most improvement by covering the then weakest point; once your software defenses are better than the physical ones, better software defenses add no (or barely any) improvement.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.