/
Navigation
Chronicles
Browse all articles
Explore
Semantic exploration
Research
Entity momentum
Nexus
Correlations & relationships
Story Arc
Topic evolution
Drift Map
Semantic trajectory animation
Posts
Analysis & commentary
Pulse API
Tech news intelligence API
Browse
Entities
Companies, people, products, technologies
Domains
Browse by publication source
Detection
Concept Search
Semantic similarity search
High Impact Stories
Top coverage by position
Sentiment Analysis
Positive/negative coverage
Anomaly Detection
Unusual coverage patterns
Analysis
Rivalry Report
Compare two entities head-to-head
Semantic Pivots
Narrative discontinuities
Crisis Response
Event recovery patterns
Connected
Search: /
Command: ⌘K
Embeddings: large
TEXXR

Chronicles

The story behind the story

← → days · ↑ ↓ browse · Enter similar · o open

FileVault 2 flaw present in macOS before version 10.12.2 allowed a $300 Thunderbolt device to steal the password of a locked or sleeping Mac

macOS FileVault2 let attackers with physical access retrieve the password in clear text by plugging in a $300 Thunderbolt device into a locked or sleeping mac.

Security | DMA Ulf Frisk

Context & Ripple Effects

Thunderbolt has been a known soft spot on the Mac since early 2015, when a researcher showed he could rewrite Mac firmware over Thunderbolt, leaving most Intel Thunderbolt Macs exposed. FileVault 2 full-disk encryption was supposed to be the backstop against exactly this kind of physical attack — which is what makes this disclosure damaging.

The new finding closes that loop: on macOS before 10.12.2, a $300 Thunderbolt device plugged into a locked or sleeping Mac retrieves the user's password in clear text, defeating the encryption entirely rather than going around it.

First-order effects

  • Anyone running macOS below 10.12.2 with FileVault 2 enabled loses the core guarantee of disk encryption against an attacker with brief physical access — updating to 10.12.2 or later becomes the only fix.
  • Apple faces another credibility hit on its security messaging, since the flaw targets the flagship feature marketed as protecting lost or stolen Macs.

Second-order effects

  • The disclosure lands amid a string of Apple authentication failures — versions after 10.12.6 unlocking System Preferences with any admin password, and the High Sierra bug letting root access with an empty password — compounding pressure on Apple to treat lock-screen and credential handling as a single audited surface rather than isolated bugs.
  • Because the attack rides the Thunderbolt port itself, scrutiny spreads beyond Macs: researchers later documented an unpatchable Thunderbolt flaw affecting PCs with physical access, pushing PC makers to confront the same port-level exposure.

Third-order effects

  • If the pattern holds, high-speed external ports get treated as a permanent attack surface requiring hardware-level defenses, not just OS patches — shifting enterprise buying criteria toward machines whose ports can be locked down or disabled.
  • Full-disk encryption gets repositioned from a complete answer to physical theft into one layer among several, with buyers and regulators increasingly expecting vendors to demonstrate resistance to physical-access attacks specifically.

The trend: Thunderbolt is evolving from a premium convenience port into a recurring cross-platform attack vector, forcing both Apple and PC makers to redesign how much trust a physical connection deserves.