{"id":14331,"date":"2022-02-17T16:06:07","date_gmt":"2022-02-17T16:06:07","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/17\/password-cracking-tool-can-slowly-hack-t2-mac-passwords\/"},"modified":"2022-02-17T16:06:07","modified_gmt":"2022-02-17T16:06:07","slug":"password-cracking-tool-can-slowly-hack-t2-mac-passwords","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/17\/password-cracking-tool-can-slowly-hack-t2-mac-passwords\/","title":{"rendered":"Password cracking tool can slowly hack T2 Mac passwords"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n


\n
\n AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content.
\n <\/em> \n <\/p>\n<\/div>\n

\n

A company that makes a password cracking tool says that a new vulnerability found in the Mac<\/a> T2 chip allows it to brute force passwords and decrypt a device. <\/p>\n

\n

Apple’s T2 chip, among other features, allows a Mac user to encrypt and decrypt data on their SSD. That encryption is bolstered by other security features, like a limit on the number of password attempts to mitigate brute force attacks. <\/p>\n<\/div>\n

\n

Because a Mac’s password isn’t stored on its SSD, bypassing this encryption meant that an attacker would need to brute force the decryption key, which could take millions of years. However, a company called Passware says it can now defeat this security mechanism. <\/p>\n<\/div>\n

\n

Passware’s unlocking tools were previously able to crack passwords on Macs without the T2 chip. A new report by 9to5 Mac<\/em> reports that<\/a> an add-on to the latest version of the software can bypass the brute force mitigation protections on a T2 chip. <\/p>\n<\/div>\n

\n

That module available for the Passware tool apparently exploits a new T2 chip vulnerability to circumvent the password attempt limit. The end result is that an attacker can apply a password dictionary and brute force a Mac’s password, allowing them to potentially decrypt the device’s data. <\/p>\n<\/div>\n

\n

Passware-enabled attacks are slow, however. The company’s password cracking tool can guess 15 passwords per second. If a user’s password is relatively long, brute forcing a Mac could still take thousands of years. Shorter passwords are more vulnerable, with a six-character password crackable in about 10 hours. <\/p>\n<\/div>\n

\n

The company is also offering a dictionary of about 550,000 commonly used passwords alongside a longer dictionary of about 10 billion passwords. <\/p>\n<\/div>\n

\n

Password’s T2-bypassing tool is available both to government customers and companies that can provide a valid justification for its usage. <\/p>\n<\/div>\n

\n

Brute forcing a Mac’s password requires physical access to your device, so the feature isn’t going to be a significant concern for most users. Users who lock down their Mac with a longer and strong device password can also rest easy knowing that a brute force attempt could take thousands of years. <\/p>\n<\/div>\n

\n

Similarly, the flaw only applies to Intel-based Macs with a T2 chip. Mac devices with Apple Silicon<\/a> or M1<\/a> chips are unaffected.<\/p>\n<\/div>\n<\/div>\n