FileVault 2 flaw present in macOS before version 10.12.2 allowed a $300 Thunderbolt device to steal the password of a locked or sleeping Mac
macOS FileVault2 let attackers with physical access retrieve the password in clear text by plugging in a $300 Thunderbolt device into a locked or sleeping mac.
Context & Ripple Effects
Thunderbolt has been a known soft spot on the Mac since early 2015, when a researcher showed he could rewrite Mac firmware over Thunderbolt, leaving most Intel Thunderbolt Macs exposed. FileVault 2 full-disk encryption was supposed to be the backstop against exactly this kind of physical attack — which is what makes this disclosure damaging.
The new finding closes that loop: on macOS before 10.12.2, a $300 Thunderbolt device plugged into a locked or sleeping Mac retrieves the user's password in clear text, defeating the encryption entirely rather than going around it.
First-order effects
- Anyone running macOS below 10.12.2 with FileVault 2 enabled loses the core guarantee of disk encryption against an attacker with brief physical access — updating to 10.12.2 or later becomes the only fix.
- Apple faces another credibility hit on its security messaging, since the flaw targets the flagship feature marketed as protecting lost or stolen Macs.
Second-order effects
- The disclosure lands amid a string of Apple authentication failures — versions after 10.12.6 unlocking System Preferences with any admin password, and the High Sierra bug letting root access with an empty password — compounding pressure on Apple to treat lock-screen and credential handling as a single audited surface rather than isolated bugs.
- Because the attack rides the Thunderbolt port itself, scrutiny spreads beyond Macs: researchers later documented an unpatchable Thunderbolt flaw affecting PCs with physical access, pushing PC makers to confront the same port-level exposure.
Third-order effects
- If the pattern holds, high-speed external ports get treated as a permanent attack surface requiring hardware-level defenses, not just OS patches — shifting enterprise buying criteria toward machines whose ports can be locked down or disabled.
- Full-disk encryption gets repositioned from a complete answer to physical theft into one layer among several, with buyers and regulators increasingly expecting vendors to demonstrate resistance to physical-access attacks specifically.
The trend: Thunderbolt is evolving from a premium convenience port into a recurring cross-platform attack vector, forcing both Apple and PC makers to redesign how much trust a physical connection deserves.