Slashdot Mirror
"Extremely Critical" OS X Keychain Vulnerability Steals Passwords Via SMS
Mark Wilson writes: Two security researchers have discovered a serious vulnerability in OS X that could allow an attacker to steal passwords and other credentials in an almost invisible way. Antoine Vincent Jebara and Raja Rahbani — two of the team behind the myki identity management security software — found that a series of terminal commands can be used to extract a range of stored credentials. What is particularly worrying about the vulnerability is that it requires virtually no interaction from the victim; simulated mouse clicks can be used to click on hidden buttons to grant permission to access the keychain. Apple has been informed of the issue, but a fix is yet to be issued. The attack, known as brokenchain, is disturbingly easy to execute. Ars reports that this weakness has been exploited for four years.
So who will defend Apple this time or attempt to minimize this or attempt to claim that other OSes are worse so that this is, seemingly, less significant. No OS is secure, it never will be and it only gets worse when you connect it to another device. There will always be security problems.
Not because I care so much but because I am easily amused...
"So long and thanks for all the fish."
Fucking clickbait.
SMS? This is an apple script exploit on a mac PC. not a mobile device. Nowhere does the article explain that SMS is an attack vector and unless iOS is vulnerable as well,I do not see how it could be.
Silence is a state of mime.
No one is going to get my passwords. They've all been safely keylogged onto Microsoft's ultrasecure telemetry cloud!
"as long as a user had already allowed the app running the script to control the Mac .. the technique works only when invoked by an application already installed on their systems. There is no evidence the technique can be carried out through drive-by exploits or attacks that don't require social engineering and end-user interaction." ref.
Won't ever defend Apple. I use many of their products but don't find their developers any better at securing their OS then Microsoft or anyone else.
Your butt would hurt less if you pulled Jobs cock out of it, paytard !
PEBCAK
Some of you clowns hate Apple so much, you will believe any unauthenticated negative you read.
I'm mixed on Apple and not fan, but it is always funny watching the "See! See! Apple is insecure too".
And then someone smart posts how ridiculous the claim is by explaining the several asterisks of the supposed exploit.
On OS X, this programmatically easier to do, but it's possible with a little more effort in Linux (if using GNOME or KDE and their password stores) and Windows (which is trickiest of all since you specifically deal with an application's store rather than a central one; presumably you'd go for a browser). the The trick is really just getting a user to run the executable in the first place.
Note that you don't use SMS to attack, just to transmit the data. OS X makes it simple to use SMS, but other systems could use HTTP or e-mail just as easily. Using SMS is just for show (and probably not a good idea since the phone number appears in the script and is logged in the process).
The big difference here is the OS X UI scripting makes the barrier to doing it much lower on that platform. A everyone's at risk.
Nearly all of our Macs were hit by that one today. Everyone that entered their password had their computer wiped. It is a nasty virus.
Yeah, sure.
Let us be speak clearly.
The LGBTQ minority has minority rights.
The LGBTQ has rights as a minority singly for plural.
Yet, the LGBTQ does not have the right to EXTERMINATE their more Hated of Enemies, The Heterosexual Homo Sapians Sapians.
NO. Right to survival is NOT right to SLAUGHTER.
LGBTQ does not have the right to slaughter heterosexual human beings.
Apple Inc. Once a wonderful technology company, once the Underdog, Always the Leader, is not the Underdog nor the Leader, Today.
Mr. Tim Cook need to understand these words clearly, and succinctly.
Mr. Tim Cook's, experiment, to turn Apple Inc. into a LGBTQ Glee Club for the advancement of LGBTQ by Slaughter of Heterosexual human beings, is a sad failure. Mr. Cook, look at the birth rates of Human Beings across the globe. Births of Heterosexuals out number LGBTQs by 1000 to 1. Mr. Cook, child of Mobile Alabama, Legacy of Slavery, Injustice, Beatings, Chemical Castration, is your legacy. Please try to think .... rationally ... logically ... humanly.
Yes, with 43 Billion dollars in cash, you, can start a Genocidal War of the Homosexuals Against the Heterosexuals. DO YOU WANT THAT! DO YOU WANT TO LOOSE AS YOUR BROTHERS DID IN THE CIVIL WAR!
Mr. Cook. You are damaged goods! For Apple to Grow and Survive, YOU, must LEAVE THE BUILDING AT CUPERTINO. NOW! As you have no family, killing you is just a mechanical exercise, all too simple. But we do not value your life as an exercise in 'mechanics'.
@
Yup.
This "Exploit" isn't in the Wild. It's "Security Theatre" meant to make a Buck. Repeat: This "Exploit" isn't in the Wild.
It's the equivalent of the local Lawnmower Kid, taking a Kool-Aid break from mowing lawns, and then letting him show how "rm-r*" at the lowest level of the Terminal on your Mac SUX6000 will wipe out your Life, unless you take out a Contract with him to prevent this from happening. Oh, the rate for Mowing Lawns is going up as well.
Don't let Lawnmower Kids near your Macs, and don't trust their advice.
as long as a user had already allowed the app running the script to control the Mac.
That's like saying this idiot can screw up my system if I log in as root and hand over the keyboard. OMG !!!
Lots of comments already that this post sucks. Trash it and get back to real reporting.
Any reason why this won't be blocked by OS X Gatekeeper?. The signatures Gatekeeper uses are automatically updated. The clueless fool who could be p0wnd by this exploit doesn't know Gatekeeper is there, running in the background and protecting him.
How is an "extremely critical" vulnerability worse than a "critical" vulnerability? Can this vacuous intensifier be quantified?
i've never trusted the keychain idea- why let a computer have all your passwords stored in one place? seems like it is just ripe to be exploited. either write them down manually(pen and paper) and store them in a safe, or just remember them. don't give up security for convenience.
Ok, now. Comb your neckbeard, lick your Cheetoh fingers and calm down. You know what worries me? Them Apples are increasingly popular. They're breeding like rabbits.
Doccus Wes: "I have used macs for years but I sure as hell won't defend Apple on this one. FOUR YEARS and they've said NOTHING? Instead, they withhold security updates for any system 3 years or more old. Frankly, I am dead sick and tired of the maroons that blame users for not using the very newest upgrade. "
Wait, what do you have against maroon? ;)