macOS APFS Password Hint Bug Dissected
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Objective-See reverse-engineers CVE-2017-7149, a patched macOS High Sierra flaw that stored APFS volume passwords in plaintext password hints.
This Objective-See blog post walks through a reverse-engineering exercise to independently rediscover the root cause of CVE-2017-7149, a vulnerability in macOS High Sierra (10.13) that was originally discovered by Matheus Mariano and later diffed by Daniel Martín. The bug caused the plaintext password used to encrypt an APFS volume to be stored and displayed as the 'password hint' instead of the actual hint text entered by the user. Any local user or attacker with access to the 'Show Hint' UI during a volume unlock prompt could recover the full encryption password, completely undermining APFS volume encryption.
The author traces the bug from the Disk Utility.app UI layer down through SUSharedActionController and SUAddAPFSVolumeSheetController classes, into the private StorageKit framework's SKAPFSContainerDisk and SKHelperClient classes, and finally into the addChildVolumeToAPFSContainer method where a copy-paste error caused the password variable to be used twice — once correctly for kSKAPFSDiskPasswordOption and erroneously again for kSKAPFSDiskPasswordHintOption — rather than using the actual password hint variable. This dictionary was then passed via XPC to the storagekitd daemon, which persisted the incorrect hint value.
Apple patched this issue in a supplemental security update for High Sierra prior to this blog's publication (the vulnerability is not a zero-day at time of writing). The post is a methodology/educational writeup demonstrating UI-level reverse engineering techniques (lldb, class-dump, breakpoints) as an alternative to patch diffing. Defenders running macOS should ensure the supplemental High Sierra security update is applied; no exploitation in the wild is reported, and the issue is historical/already remediated.
Mentioned in this report
Source reporting: https://objective-see.org/blog/blog_0x23.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs