In plain words
Think of an encrypted volume like a safe in your house where you store valuable things. Normally only you can open it with your key. But this bug was like a master key that let someone else open the safe without your permission.¹
What's broken
The bug is called CVE-2017-7149² and it was in the High Sierra operating system. It allowed attackers who already had access to a Mac to see the contents of encrypted volumes without needing the password. This is a big problem because encrypted volumes are supposed to be secure even if someone gets into your computer.
How it actually works
Here's how it actually works: when you encrypt a volume on a Mac it uses a system called APFS³. The bug was in how APFS handled access to the encrypted data. Normally APFS would check if you had permission to access the data but because of the bug it didn't do that check correctly. So if an attacker had local access to the Mac they could use the bug to get to the encrypted data without needing the password. This is because the bug let them bypass the normal security checks that APFS is supposed to do.
Proof of concept
There is a proof of concept (PoC)⁴ for this bug which means that researchers have shown that it's real and can be used to access encrypted volumes. A PoC is like a demonstration that the bug is not just theoretical but actually works in practice. This makes it more urgent for users to update their systems because it shows that the bug can be exploited. The PoC demonstrates that the flaw is real and reachable not just theoretical.
Is it real
It's not clear from the source if this bug is being actively exploited in the wild. However the bug was in a feature that was on by default in High Sierra which made it a significant risk. The limiting factor was that an attacker needed to already have local access to the Mac to use the bug.
What to do
To fix this bug users needed to update their Macs to a newer version of the operating system that did not have the bug. This would patch the vulnerability and prevent attackers from using it to access encrypted volumes. Users should also make sure to use strong passwords and keep their operating system up to date to protect against other security threats.
Terms
- ¹ CVE
- , A unique identifier for a security vulnerability
- ² APFS
- , A system used to manage and organize data on a computer
- ³ PoC
- , A demonstration that a security vulnerability is real and can be exploited