New (local) Mac OS X vulnerability : Passwords in Swap files

[Nomad559]

http://www.macdevcenter.com/pub/wlg/5125

Apparently, swap files in Mac OS X (as of 10.3.4) contain user passwords in clear text.

Run the following on your Mac OS X box to see if you can find your passwords stored in clear text: sudo strings -8 /var/vm/swapfile0 |grep -A 4 -i longname

At first, this 'vulnerability' may not seem like such a big deal. After all, the swap files are only readable by root. However, a system administrator should not have it so easy if he or she would want to obtain user passwords. Passwords should never be stored in clear text _anywhere_. A malicious trojan with root privileges can now steal user password in clear text, and many users use same passwords for other accounts, so this is a big deal. In addition, Keychain passwords are also apparently stored in clear text within the swap files

[benburch]

1. I don't think this is a big deal...

First, nobody but the owner ever uses most OSX systems.

Second, it is easy for Apple to fix, and no doubt they will soon.

Third, the same issue exists in Linux, and nobody seems to be worried about that.

[Renew Deal]

3. Nobody but the owner?

Does that include employees who aren't the owners and kiosk machines? What about running a script that uploads the swap file up to some ftp server? There are ways to take advantage of this.

Also, why would Apple fix this if it is standard in Linux? And you are saying that Linux says passwords in clear text in the swap file? That's hard to believe.

[benburch]

4. In Linux...

There is a "device" called /dev/ram that somebody with root privs can read and which is an image of all of the contents of memory. Including whatever password you just typed in.

[Renew Deal]

2. That's really bad.