Apple logging passwords in plain text

Lion debug ‘feature’ breaks security

A post to Cryptome is pointing the finger at Apple for logging plain-text passwords of users of “legacy” Filevault under Lion 10.7.3.

According to David Emery, the February update of Lion turned on a debug switch which, as a result, logs in plain text the password of a user of an encrypted directory tree. “Thus anyone who can read files accessible to group admin can discover the login passwords of any users of legacy (pre LION) Filevault home directories who have logged in since the upgrade to 10.7.3 in early February 2012,” the post notes.

It’s not the first time this logging behavior has been spotted, but only with the Cryptome post has it strayed beyond one post to Apple and a thread on Novell’s forums wondering what’s going on.

Emery says the log is accessible via a number of approaches, including opening the machine’s drive in Firewire disk mode, or booting via the recovery partition.

One of the Novell thread posters suggests symlinking /var/logs/secure.log to /dev/null to kill the logging.

While the passwords are only locally available, Emery notes that the logging breaks the "family security" model in which different users of the same machine are kept away from each others' files. ®