OId OS X FileVault vulnerable to password hacks

David I. Emery wrote on Cryptome that a debugging switch inadvertently left on in the current release of Lion, version 10.7.3, records in clear text the password needed to open the folder encrypted by the older version of FileVault.

Users who are vulnerable are those who upgraded to Lion but are using the older version of FileVault. The debug switch will record the Lion passwords for anyone who has logged in since the upgrade to version 10.7.3, released in early February.

"This is what the secure FileVault partition was supposed to protect against after all," Emery said in an interview.

Apple has two versions of FileVault. The first version allowed a user to encrypt the contents of the home folder using the Advanced Encryption Standard (AES) with 128-bit keys. An upgraded product, FileVault 2, which shipped with OS X Lion, encrypts the entire content of the hard drive.

When someone upgrades to Lion but still uses the first version of FileVault, the encrypted home folder is migrated, which is now vulnerable with this security issue. Emery wrote that the password is accessible to anyone with root or administrator access, he wrote. But what is worse is that passwords can also be read another way.

Emery described that passwords can also be read by "booting the machine into FireWire disk mode and reading it by opening the drive as a disk or by booting the new-with-Lion recovery partition and using the available superuser shell to mount the main file system partition and read the file."