Slashdot Mirror
Apple Releases macOS High Sierra; Ex-NSA Hacker Publishes Zero-Day
Apple today released the newest version of its operating system for Macs, macOS High Sierra, to the public. macOS High Sierra is a free download, and offers a range of new features and improvements including the new Apple File System, and support for High Efficiency Video Encoding (HEVC) for better compression without loss of quality, and HEIF for smaller photo sizes. Zack Whittaker, reporting for ZDNet: Patrick Wardle, a former NSA hacker who now serves as chief security researcher at -- Synack, posted a video of the hack -- a password exfiltration exploit -- in action. Passwords are stored in the Mac's Keychain, which typically requires a master login password to access the vault. But Wardle has shown that the vulnerability allows an attacker to grab and steal every password in plain-text using an unsigned app downloaded from the internet, without needing that password.
Nice quote. Stay on topic, please.
It's ambiguous and sometimes can mean the exact opposite of the intended message, especially when used in short click-baity headlines. How about 'publishes,' 'releases,' or 'exposes' here?
It seems inevitable that security holes will be in modern systems. We can argue about the why, or how this system is better than that system. But there is seemingly no end to vulnerabilities simply because of the complexities of modern systems. Too many variables, and it only takes one hole in the fence for the raptors to get through.
Be kind, for everyone you meet is fighting a difficult battle. - Plato
This hack affects High Sierra as well as older versions according to the article. The title of this implies that this is specifically something related only to the new OS.
Huh?
I saw this JUST after I upgraded to High Sierra, and was a little annoyed. NOPE. Turns out older versions are also vulnerable, so description is slightly mis-leading. This is NOT a High-Sierra specific exploit, this is just a MacOS exploit. Hopefully we can get a patch ASAP!
Be sure to note this is yet another security leak on Trump's watch.
right?
However the user does need to download and run the app - so the current iteration isn't problematic (nor is it intended to be). And, since it's unsigned, I'm assuming it won't work for most users by default - unless, like me, you change that setting.
I'm certain we'll see this weapon used soon enough, though... and we regularly do see users get manipulated into running things they shouldn't, even when lots of warning boxes pop up along the way. Plus it's always possible there's another way to exploit the flaw which doesn't have to run under the specific user's account.
#DeleteChrome
what do you know. the whore of all things proprietary is at it again.
just like every single security issue we read of usually means a full 100% compromise of the system, and just like Apple has had a tendency in the past to prolong fixing certain security issues by months and months. You think Apple and the big brother has no way into your Mac and iCloud? Think again.
will no doubt be called 'Death Valley' to cover the lowest elevation in California, followed by Mt Whitney..
BE AFWAID! BE VEWWY AFWAID!
Because hackers, with hacks, hacking. You heard the man. Hackers! NSA-HACKERS! WITH HACKS! BE AFWAID!
I think the new new new editors are not-so-secretly redmond fanbois.
Synack is now on my shit-list for employing people who are not disclosing responsibly. This was purely a PR stunt to get his company name out there. Fuck that guy. Fuck his company.
Seems like the zero-day isn't High Sierra specific, seems kinda odd to tack this on to a headline regarding today's release.
...we need to just drop using drop as a synonym for "released."
Never let a lack of data get in the way of a good rant.
This flaw can be exploited by hackers to hide a malicious code in one of the popular macOS app. All they need is to find a few careless developers with poor security. Or to even buy a cheap but popular app.
that the password wasn't used to create the symetric key that encrypts the passwords making it "mathematically impossible" to recover them without the password.
Looking to boost their market share clearly. On /. we have people that know the difference between zero-day and user must download malware and do whatever the malware asks you to do to enable the exploit. Also, in a bonus of unlikelihood the app is unsigned.
freed up 30 gigs on my 128gb ssd.
No on both counts—the app demonstrated in the movie is for proof of existence. The relevant code could exist in any application, even apps MacOS users already have and have been using (since this security flaw is old and also affects earlier variants of MacOS). In other words, sensitive data could have already been uploaded somewhere including changes to those credentials.
Apple's security is not only totally unimpressive here, Apple has a horrible track record as well. Wardle was quoted as saying he's "continually disappointed in the security of macOS...", "...every time I look at macOS the wrong way something falls over", and "Apple marketing has done a great job convincing people that macOS is secure, and I think that this is rather irresponsible and leads to issues where Mac users are overconfident and thus more vulnerable". I don't know precisely what Wardle was referring to to draw that conclusion. Perhaps he is referring to the time Apple chose to leave a 3-year old remotely exploitable iTunes bug unfixed after being informed about the problem. As Richard Stallman pointed out, "During that time, governments used that security hole to invade people's computers.".
But the worst part is that the software in question is proprietary (in other words, it's user-subjugating and non-free). So even technical users who are motivated to fix this, capable of fixing the problem, and willing to help others by distributing copies of their fix to other MacOS users in an easy-to-install package are rendered helpless. Such technically-inclined and helpful users can't help themselves or their community. They can either switch to a free system where their software freedom is respected or wait for Apple to fix the problem. And as the article says, "Apple did not say if or when it will patch the bug.".
Digital Citizen