Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Flaw in OS X displays all keychain passwords in plain text

medium.com

Post reply on HN
Print view View original

1–10 of 57 posts

Re: Security Flaw in OS X displays all keychain passwords in plain text

#4

Post by ajani »

Just tried this on my mac. And yes, It did output something. But the passwords aren't in plain text. It outputs, what looks like at first glance, encrypted passwords.

Maybe there is an easy way to decrypt them using some other information in the output, but I haven't looked further.

Re: Security Flaw in OS X displays all keychain passwords in plain text

#5

Post by aftaylor2 »

ajani wrote: post #4

Just tried this on my mac. And yes, It did output something. But the passwords aren't in plain text. It outputs, what looks like at first glance, encrypted passwords. Maybe there is an easy way to decrypt them using some other information in the output, but I haven't looked further.

I can confirm this works on 10.11.5 ( El Capitan ). To confirm, you can "cat keychain.txt | grep -i SECTION_OF_YOUR_PASSWORD". However, you must click Allow on each dialog, or Always Allow.

Re: Security Flaw in OS X displays all keychain passwords in plain text

#6

Post by gilgoomesh »

ajani wrote: post #4

Just tried this on my mac. And yes, It did output something. But the passwords aren't in plain text. It outputs, what looks like at first glance, encrypted passwords. Maybe there is an easy way to decrypt them using some other information in the output, but I haven't looked further.

Did you run the AppleScript? I got the expected error:

> error "System Events got an error: Can’t get group 1 of window 1 of process \"SecurityAgent\". Invalid index." number -1719 from group 1 of window 1 of process "SecurityAgent"

You're not supposed to be able to script SecurityAgent – and it doesn't work on my computer. Specifically, security windows should appear empty when read by other processes.

Re: Security Flaw in OS X displays all keychain passwords in plain text

#7

Post by csydas »

ajani wrote: post #4

Just tried this on my mac. And yes, It did output something. But the passwords aren't in plain text. It outputs, what looks like at first glance, encrypted passwords. Maybe there is an easy way to decrypt them using some other information in the output, but I haven't looked further.

Snippet from the man page for security:

https://developer.apple.com/legacy/library/documentation/Dar...

>dump-keychain [-adhir] Dump the contents of one or more keychains.

            -a              Dump access control list of items
            -d              Dump (decrypted) data of items
            -i              Interactive access control list editing mode
            -r              Dump raw (encrypted) data of items
I'm not at my Mac so can't test what it means by "dump decrypted", but I don't think it dumps all data in plain-text as the article suggested. I am curious if the keychain was unlocked when they did it for whatever reason.

I still question why such an ability exists through terminal without more control, but it's not quite as described.

edit: was very unclear I was posting a snippet of the actual command. fixed

Re: Security Flaw in OS X displays all keychain passwords in plain text

#8

Post by jmiserez »

That only allows exporting the passwords of the currently logged-in user.

If you let someone untrusted (!) log in remotely to your computer with your user account or you give it to someone while your user is logged in it's your own fault if your keys get stolen. You should use a guest account with restricted privileges or a separate machine.

It's not much different on Linux, if you use Gnome-Keyring (used by default in Ubuntu and others) you can also get the passwords easily, in plain text [1].

Not sure about Windows, but you can most likely get to the passwords without installing anything as well if you're already logged in as the current user. If you're allowed to run executables, there are quite a few already [2].

[1] https://blog.schmichael.com/2008/10/30/listing-all-passwords...

[2] http://www.nirsoft.net/password_recovery_tools.html

Re: Security Flaw in OS X displays all keychain passwords in plain text

#10

Post by coldcode »

csydas wrote: post #7
ajani wrote: post #4

Just tried this on my mac. And yes, It did output something. But the passwords aren't in plain text. It outputs, what looks like at first glance, encrypted passwords. Maybe there is an easy way to decrypt them using some other information in the output, but I haven't looked further.

Snippet from the man page for security: https://developer.apple.com/legacy/library/documentation/Dar... >dump-keychain [-adhir] Dump the contents of one or more keychains. -a Dump access control list of items -d Dump (decrypted) data of items -i Interactive access control list editing mode -r Dump raw (encrypted) data of items I'm not at my Mac so can't test what it means by "dump decrypted", but I don't think it dum…

dump-keychain: command not found
Post reply on HN