Mac OS Lion Memory Forensics Using IEEE 1394 to Bypass FileVault 2 Full Volume Encryption. Todd Garrison September 18, 2011

Copyright © 2011 Todd Garrison. This work is licensed under the Creative Commons Attribution-NonCommercial 3.0 Unported License. To view a copy of this license, visit or send a letter to Creative Commons, 444 Castro Street, Suite 900, Mountain View, California, 94041, USA.

Overview Mac OS 10.7 (Lion) includes a full-volume encryption product called FileVault 2. o It is possible to use IEEE 1394/Firewire to extract a user’s password from the RAM of a running system, and in most cases a sleeping system once it has been woken up. o This password can be used to decrypt the volume, or to login to the system. o Using Firewire in this manner is a well-known method of gaining access to an operating system, with published attack methods dating back to Lion uses a set of countermeasures designed to prevent this attack. o There are weaknesses in the implementation. Default settings allow the protections to be bypassed. o Changing three settings can protect against the attack in most cases.

Tools to Extract RAM libforensic1394 o Written by Freddie Witherden and released in o Available at: o Python and C library that works on Linux (JuJu Firewire stack) and Mac OS (IOKit libraries). o Does not supply programs to perform capture, so a Python script was written to perform capture. Available at: pythonraw1394 o Written by Adam Boileau and released in o Original website no longer available, mirrored copy at: tgz tgz o Python and C library that uses raw1394 Linux kernel module (no longer available on most Linux distributions.) Also supplies programs for performing memory capture and more.

Applicability The attack is possible in most system states. o The user has logged off of the system. o The system has been locked via the screensaver, “User Switching” is enabled (default setting,) and there is more than one user account on the system. o The system has been booted, but a user has not logged in. Not a default system configuration when FileVault 2 is enabled. Plaintext passwords are not available, SHA2-512 hashes are in RAM. When do the countermeasures apply? o When the screen saver is active and requires a password. Can be bypassed by selecting “Switch User” (if available.) o When the system is requesting authentication to gain access to the full- volume encryption key. Normally this is done at boot time, but can also be configured to work after waking from sleep.

Can the System be Imaged?

Protecting Against Firewire DMA Several settings are suggested, and should protect against most attempts to gain access: o Disable User Switching feature. o Configure system to store RAM to disk and remove power to memory upon sleep state. o Configure system to remove full-volume encryption key upon sleep. Other settings: o Always use a strong password for every user. Any user’s password can be used to decrypt the volume. o Do not disable screen locking: Set a reasonable time for automatically locking. Configure the system to sleep if it has been idle for a long time.

Disable User Switching Can be disabled in “System Preferences,” “Users and Groups,” “Login Options.” o Uncheck the “Show fast user switching menu as...” option.

Sleep Options Must be performed as the “root” user from the Unix shell. o Uses the dmset program to change two values: o Example: OptionValueDescription destroyfvkeyonstandby 1Removes the full volume encryption key from RAM when the system is put into sleep mode and is dependent on the value of hibernatemode. hibernatemode 25Forces the system to immediately write RAM to disk and remove power from memory upon sleep.

Conclusion Encryption products are designed to protect data when a third party gains physical access to a computer. o Unfortunately, the system is not secure when using the default settings. o It is simple to configure the system in a secure state. It may be possible for Apple to extend the restrictions for Firewire DMA, but for now it is suggested that the recommended configuration options be set on computers containing confidential information. o There are also other interfaces (such as Thunderbolt and SDXC) that may exhibit the same vulnerabilities. o FileVault 2 is new software; it is likely there are other attack vectors available.

Bibliography IEEE Standard for a High-Performance Serial Bus. (2008). IEEE Standards Association. Apple - OS X Lion - The world’s most advanced OS. (n.d.). Retrieved September 17, 2011, from Apple - Thunderbolt: Next-generation high-speed I/O technology. (n.d.). Retrieved September 17, 2011, from Boileau, A. (2006). pythonraw1394. Dalrymple, J. (2011, July 26). Lion FireWire security issue misleading. Retrieved September 17, 2011, from Fleischer, G. (2011, July 12). File Vault in Mac OS X Lion - k3t’s weblog. Retrieved September 3, 2011, from Garrison, T. (2011, September 7). Cracking MacOS Lion Passwords. Retrieved September 17, 2011, from Garrison, T. (2011, September 17). Mac OS Lion Forensic Memory Acquisition Using IEEE Graham, R. (2011, February 24). Errata Security: Thunderbolt: Introducing a new way to hack Macs. Retrieved September 17, 2011, from introducing-new-way-to-hack.htmlhttp://erratasec.blogspot.com/2011/02/thunderbolt- introducing-new-way-to-hack.html Hermann, U. (2008, August 14). Physical memory attacks via Firewire/DMA - Part 1: Overview and Mitigation (Update) | Uwe Hermann. Retrieved September 17, 2011, from uwe.de/blog/physical-memory-attacks-via-firewire-dma-part-1-overview-and-mitigationhttp:// uwe.de/blog/physical-memory-attacks-via-firewire-dma-part-1-overview-and-mitigation Jacob. (2011, July 21). Lion Tips, a Collection | The Tech Bulletin. Retrieved September 17, 2011, from Koukoushkina, N. (2011, July 26). Passware Proves Mac OS Lion Insecure Revealing Login Passwords in Minutes. Retrieved from OS X Lion: About FileVault 2. (2011, July 26). Retrieved September 17, 2011, from pmset(1) Mac OS X Manual Page. (n.d.).Mac OS X Developer Library. Retrieved September 17, 2011, from Schuster, A. (2008, February). Memory analysis: “Acquisition (5): FireWire” - Computer Forensic Blog. Retrieved September 13, 2011, from Technical Note TN2124: Technical Note TN2124. (n.d.). Retrieved September 3, 2011, from Witherden, F. (2010, September 7). Memory Forensics over the IEEE 1394 Interface. Retrieved from