Situation: Filevault 2 passwords can be stolen
Passware has released the Passware Kit Forensic 11.3 which is able to steal the FileVault 2 password from the RAM by performing a DMA Attack via the FireWire port.
They state that their software:
- recovers Mac User Login passwords and FileVault keys from computer memory and
- decrypts TrueCrypt and FileVault volumes in minutes.
Various suggestions have been made trying to describe how to protect a Mac with Filevault 2 from such an attack:
sudo pmset -a destroyfvkeyonstandby 1 hibernatemode 25
This will remove the full volume encryption key from RAM when the system is put into sleep mode and forces the system to immediately write RAM to disk and remove power from memory upon sleep.
Question:
What user behavior is necessary and what steps does one have to take for maximum protection with FileVault 2 on the Mac?