Tell me more ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.
up vote 3 down vote favorite

With the latest Lion security update, Mac OS X 10.7.3, Apple has accidentally turned on a debug log file outside of the encrypted area that stores the user’s password in clear text.

How can I determine whether my system if affected by this issue? If so, can I work around it, and also determine which users’ passwords have been exposed?

share|improve this question

1 Answer

up vote 5 down vote accepted

As stated in the article linked in the question:

Anyone who used FileVault encryption on their Mac prior to Lion, upgraded to Lion, but kept the folders encrypted using the legacy version of FileVault is vulnerable. FileVault 2 (whole disk encryption) is unaffected.

The password shows up in /var/log/secure.log. To look for it, log in as an Administrator, open Terminal.app and run

sudo grep -i passwordAsUTF8String /var/log/secure.log

Have a look at the result (if any) to see whether passwords appear in plain text.

For additional information see

share|improve this answer
And if my significant other doesn't really remember what he did on his laptop, how can I confirm if it is affected or not? – F'x May 7 '12 at 8:58
Is FileVault enabled for his home directoy (have a look System Preferences)? – patrix♦ May 7 '12 at 9:41
Yes, FileVault is enabled. How do I know if it was migrated and kept to a legacy version? – F'x May 7 '12 at 9:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.