macOS Breaks Your OpSec by Caching Data From Encrypted Hard Drives

guest · Jun 18, 2018

macOS Breaks Your OpSec by Caching Data From Encrypted Hard Drives
June 18, 2018
https://www.bleepingcomputer.com/ne...c-by-caching-data-from-encrypted-hard-drives/

Apple's macOS surreptitiously creates and caches thumbnails for images and other file types stored on password-protected / encrypted containers (hard drives, partitions), according to Wojciech Reguła and Patrick Wardle, two macOS security experts.

The problem is that these cached thumbnails are stored on non-encrypted hard drives, in a known location and can be easily retrieved by malware or forensics tools, revealing some of the content stored on encrypted containers.
"Leak" known for years
Users using encrypted containers to safeguard files from intrusive eyes may be unaware that they might be leaking information via the thumbnail cache or via the QuickLook functionality.

However, with political regimes around the world cracking down on dissident voices with top-of-the-line tech and increased brutality, both Reguła and Wardle have now published blog posts detailing this mechanism in the hopes of alerting users about the issue in order to take preemptive measures.
Click to expand...

mirimir · Jun 18, 2018

Well, the key here is not having any non-encrypted storage available to the device. Only connect a backup drive when backing up. That protects against cryptlockers too. And anyway, all external storage should be encrypted as well. I use Linux, and all of my external drives use LUKS.

Log in or Sign up

macOS Breaks Your OpSec by Caching Data From Encrypted Hard Drives

guest Guest

mirimir Registered Member

Log in or Sign up

macOS Breaks Your OpSec by Caching Data From Encrypted Hard Drives

guest Guest

mirimir Registered Member

Useful Searches