Skip to main content

Hacked in 30 seconds: Thunderbolt flaw in Mac computers can disclose passwords that fast

If you run any type of Thunderbolt device on your Mac, you’ll want to upgrade to MacOS 10.12.2 in short order. The latest update fixes a vulnerability in FileVault 2 — Apple’s second-generation full disk encryption platform — that allowed the disclosure of your system password by simply plugging in a $300 Thunderbolt device.

This device was able to gain access even when the Mac was asleep, researchers said. The hack works by forcing the computer into a reboot (ctrl+cmd+power), plugging in the special Thunderbolt device, and waiting about 30 seconds for the password to appear.

Recommended Videos

Security researcher Ulf Frisk says the issue is the result of two problems, one being the fact that Macs do not protect themselves from Direct Memory Access (DMA) attacks before the computer is started. The other is that the FileVault password is stored in clear text in memory and not automatically scrubbed once the disk is unlocked.

The password is put in multiple locations, and does apparently change location after reboots. However, it’s in a specific memory range making it fairly easy to scan for and eventually find. Frisk notified Apple of the vulnerability in August, and agreed to withhold it pending a fix, he wrote in a blog post.

“Anyone, including but not limited to your colleagues, the police, the evil maid, and the thief will have full access to your data as long as they can gain physical access – unless the Mac is completely shut down,” Frisk pointed out.

Mac OS 10.12.2 was released last week and fixed a variety of issues including a more reliable auto unlock, graphics, and System Integrity Protection (SIP) issues on some 2016 MacBook Pros, along with a host of other stability improvements.

The Thunderbolt vulnerability was only one of the many security updates in this release: if you’re interested you can learn more about those updates from Apple’s website.

Ed Oswald
For fifteen years, Ed has written about the latest and greatest in gadgets and technology trends. At Digital Trends, he's…
OLED MacBook Pros can’t come soon enough
Apple MacBook Pro 16 front angled view showing display and keyboard.

OLED MacBooks have been rumored for years now, but ever since the OLED iPad Pro launch, it's turned up the heat on speculation around when Macs will get the technology. And now, in a new report, global tech analyst group Omdia has shed light on the murky subject. While some sources have speculated 2025, and others 2027, Omdia's principal analyst Ricky Park says 2026 is "highly likely."

That might come as a disappointment to some who'd hoped for the massive update to come in the next generation of MacBook Pros, which would launch in late 2024 or 2025.

Read more
Here are 5 macOS 15 features that I can’t wait to see
Apple CEO Tim Cook walks off stage after speaking during the Apple Worldwide Developers Conference.

Apple’s Worldwide Developers Conference (WWDC) is less than a month away, meaning it’ won't be long before we find out exactly what sort of updates are coming to macOS 15. It’s always an exciting time for Mac users, as we get to find out what Apple is doing to tune up its operating systems and improve the Mac experience for all of us.

By this stage, we’ve already seen a bunch of intriguing leaks hinting at what’s coming in macOS 15. There are a few things I really want Apple to fix, as well as plenty of cool features heading our way if the rumors prove to be correct.

Read more
Why Samsung’s answer to the MacBook Pro can’t quite compete
The Galaxy Book4 Ultra open on a wooden suruface.

The 16-inch MacBook Pro is the king of the creator laptops, and it's been that way for several years.

But there have been a wave of new Windows laptops attempting to challenge the MacBook Pro on its own terms. The Samsung Galaxy Book4 Ultra is certainly a contender, packing some impressive specs in a portable chassis. When you compare the two straight up, the MacBook Pro 16-inch clearly comes away with the upper hand, even when considering its higher price.
Specs and pricing

Read more