Paper discussing how the the standard Apple Filing Protocol (AFP) does not use encryption to protect transfered data. Login credentials may be sent in cleartext or protected with one of several different hashed exchanges or Kerberos. There does not appear to have been any serious third-party security review of Apple’s client or server implementations.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/32780/MacOSXAFP.txt
Source: https://packetstormsecurity.com/files/32780/MacOSXAFP.txt.html