32
macOS Breaks Your OpSec by Caching Data From Encrypted Hard Drives

macOS Breaks Your OpSec by Caching Data From Encrypted Hard Drives

5 years ago
Anonymous $cyhBy-qkd5

https://www.bleepingcomputer.com/news/apple/macos-breaks-your-opsec-by-caching-data-from-encrypted-hard-drives/

Apple's macOS surreptitiously creates and caches thumbnails for images and other file types stored on password-protected / encrypted containers (hard drives, partitions), according to Wojciech ReguĊ‚a and Patrick Wardle, two macOS security experts.

The problem is that these cached thumbnails are stored on non-encrypted hard drives, in a known location and can be easily retrieved by malware or forensics tools, revealing some of the content stored on encrypted containers.