Slashdot Mirror
"Extremely Critical" OS X Keychain Vulnerability Steals Passwords Via SMS
Mark Wilson writes: Two security researchers have discovered a serious vulnerability in OS X that could allow an attacker to steal passwords and other credentials in an almost invisible way. Antoine Vincent Jebara and Raja Rahbani — two of the team behind the myki identity management security software — found that a series of terminal commands can be used to extract a range of stored credentials. What is particularly worrying about the vulnerability is that it requires virtually no interaction from the victim; simulated mouse clicks can be used to click on hidden buttons to grant permission to access the keychain. Apple has been informed of the issue, but a fix is yet to be issued. The attack, known as brokenchain, is disturbingly easy to execute. Ars reports that this weakness has been exploited for four years.
So who will defend Apple this time or attempt to minimize this or attempt to claim that other OSes are worse so that this is, seemingly, less significant. No OS is secure, it never will be and it only gets worse when you connect it to another device. There will always be security problems.
Not because I care so much but because I am easily amused...
"So long and thanks for all the fish."
SMS? This is an apple script exploit on a mac PC. not a mobile device. Nowhere does the article explain that SMS is an attack vector and unless iOS is vulnerable as well,I do not see how it could be.
Silence is a state of mime.
No one is going to get my passwords. They've all been safely keylogged onto Microsoft's ultrasecure telemetry cloud!
"as long as a user had already allowed the app running the script to control the Mac .. the technique works only when invoked by an application already installed on their systems. There is no evidence the technique can be carried out through drive-by exploits or attacks that don't require social engineering and end-user interaction." ref.
Gosh. You sure told them!
Hey turdnibble, it is a bad exploit...I'm no fanboi, juts pointing out the articles stupidity.
Silence is a state of mime.
Some of you clowns hate Apple so much, you will believe any unauthenticated negative you read.
I'm mixed on Apple and not fan, but it is always funny watching the "See! See! Apple is insecure too".
And then someone smart posts how ridiculous the claim is by explaining the several asterisks of the supposed exploit.
On OS X, this programmatically easier to do, but it's possible with a little more effort in Linux (if using GNOME or KDE and their password stores) and Windows (which is trickiest of all since you specifically deal with an application's store rather than a central one; presumably you'd go for a browser). the The trick is really just getting a user to run the executable in the first place.
Note that you don't use SMS to attack, just to transmit the data. OS X makes it simple to use SMS, but other systems could use HTTP or e-mail just as easily. Using SMS is just for show (and probably not a good idea since the phone number appears in the script and is logged in the process).
The big difference here is the OS X UI scripting makes the barrier to doing it much lower on that platform. A everyone's at risk.
Exactly. It takes the fool to allow it to happen.
On a bigger picture note - security needs to be more important for the end user. I think people tend to think that smart phones are less likely to be exploited than a PC and that bad things won't happen. People need to understand how to secure their phones and what behavior they should guard against.