FileVault and QuickLook leak some information from encrypted volumes in Mac OS
If you use FileVault and QuickLook on a Mac you may want to know that the combination of the two may leak some sensitive information from encrypted volumes.
Reader Jack R. sent in the following tip, explaining the situation further:
When FileVault and QuickLook are used concurrently, information about what files are stored on the encrypted volume becomes available and completely unencrypted on your hard drive. This is due to QuickLook’s thumbnail caching that is stored within the /var/ directory.
Run the following command to see the size of the QuickLook cache to demonstrate the potential:
find /var/folders -name "*QuickLook*" -exec du -h {} \; 2>/dev/null
The worst case scenario is the potential for exposing file names and even QuickLook thumbnails of documents and images. There’s also a sqlite file called index.sqlite within the /var/folders QuickLook cache directories that have a list of file names on the encrypted volumes.
Whether or not this is a legitimate security hole that is patchable or if it’s something I’m aimlessly worried about, I don’t know, but I am willing to bet many people don’t know about this!
Editor note: This definitely seems like a security hole. I imagine the best way to avoid this problem is to just not use QuickLook on the sensitive encrypted data, although that’s more of a workaround than a fix. Perhaps Mac OS X will eventually get a security update to resolve the problem.
Update 6/18/2018: Over 8 years later, this security bug still exists in MacOS / Mac OS X! That’s the bad news. But here’s the good news; security researcher Patrick Wardle has brought some renewed attention to this flaw and thus it will likely get patched in a future software update.
In the meantime, Wardle recommends the following command string to delete the Quick Look cache, which can be entered into the Terminal of MacOS / Mac OS X:
qlmanage -r cache
Executing that command will clear the Quick Look cache. Keep an eye out for future security updates and software updates to Mac OS as they will likely patch the bug once and for all.