Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Flaw in OS X displays all keychain passwords in plain text

medium.com

Post reply on HN
Print view View original

11–20 of 57 posts

Re: Security Flaw in OS X displays all keychain passwords in plain text

#11

Post by coldcode »

coldcode wrote: post #10
csydas wrote: post #7

Earlier quoted context omitted.

Snippet from the man page for security: https://developer.apple.com/legacy/library/documentation/Dar... >dump-keychain [-adhir] Dump the contents of one or more keychains. -a Dump access control list of items -d Dump (decrypted) data of items -i Interactive access control list editing mode -r Dump raw (encrypted) data of items I'm not at my Mac so can't test what it means by "dump decrypted", but I don't think it dum…

dump-keychain: command not found

http://apple.stackexchange.com/questions/184897/how-to-dump-... This is nothing new apparently

Re: Security Flaw in OS X displays all keychain passwords in plain text

#13

Post by throwaway2016a »

cocotino wrote: post #3

tell process "SecurityAgent" click button "Allow" of group 1 of window 1 I'm pretty certain this is not possible in any recent version of OS X.

Same for me: "System Events got an error: Can’t get window 1 of process "SecurityAgent". Invalid index."

Re: Security Flaw in OS X displays all keychain passwords in plain text

#14

Post by throwaway2016a »

ajani wrote: post #4

Just tried this on my mac. And yes, It did output something. But the passwords aren't in plain text. It outputs, what looks like at first glance, encrypted passwords. Maybe there is an easy way to decrypt them using some other information in the output, but I haven't looked further.

I can confirm that at least on mine the passwords are definitely plain text (also includes some private keys) but the Apple script doesn't work for me so there doesn't seem to be a way to suppress the Allow/Deny box.

I am a little surprised it doesn't ask foe the keychain password.

Re: Security Flaw in OS X displays all keychain passwords in plain text

#15

Post by gilgoomesh »

jmiserez wrote: post #8

That only allows exporting the passwords of the currently logged-in user. If you let someone untrusted (!) log in remotely to your computer with your user account or you give it to someone while your user is logged in it's your own fault if your keys get stolen. You should use a guest account with restricted privileges or a separate machine. It's not much different on Linux, if you use Gnome-Keyring (used by default…

Simply being logged in is not sufficient.

The only way this should be possible on the Mac is if a logged in user physically at the computer selects "Allow" or "Always allow" for each security dialog that appears. Remote sessions are not permitted to do this.

Security dialogs cannot be scripted under normal circumstances (the AppleScript given in the article simply doesn't work). I suspect it might be possible to do highly dangerous things like blessing the "System Events" tool as an Accessibility tool in the Security System Prefs Pane (which would allow it to send events to security dialogs) but I'm not totally sure that's possible and in any case, I don't think that's happening here. I think the author is simply mistaken or has clicked "Always allow" in the past and doesn't realize that this setting is still active.

Re: Security Flaw in OS X displays all keychain passwords in plain text

#16

Post by csydas »

coldcode wrote: post #10
csydas wrote: post #7

Earlier quoted context omitted.

Snippet from the man page for security: https://developer.apple.com/legacy/library/documentation/Dar... >dump-keychain [-adhir] Dump the contents of one or more keychains. -a Dump access control list of items -d Dump (decrypted) data of items -i Interactive access control list editing mode -r Dump raw (encrypted) data of items I'm not at my Mac so can't test what it means by "dump decrypted", but I don't think it dum…

dump-keychain: command not found

ah, I was not clear I was posting a snippet from the man, and also forgot the link to it. mybad

Re: Security Flaw in OS X displays all keychain passwords in plain text

#17

Post by dfraser992 »

ajani wrote: post #4

Just tried this on my mac. And yes, It did output something. But the passwords aren't in plain text. It outputs, what looks like at first glance, encrypted passwords. Maybe there is an easy way to decrypt them using some other information in the output, but I haven't looked further.

On 10.8, the command certainly does output unencrypted passwords. There is a lot of cruft in the XML-like file that I haven't figured out (I deleted the text file as fast as I could...) but the passwords were clearly visible.

Re: Security Flaw in OS X displays all keychain passwords in plain text

#18

Post by pdxandi »

throwaway2016a wrote: post #14
ajani wrote: post #4

Just tried this on my mac. And yes, It did output something. But the passwords aren't in plain text. It outputs, what looks like at first glance, encrypted passwords. Maybe there is an easy way to decrypt them using some other information in the output, but I haven't looked further.

I can confirm that at least on mine the passwords are definitely plain text (also includes some private keys) but the Apple script doesn't work for me so there doesn't seem to be a way to suppress the Allow/Deny box. I am a little surprised it doesn't ask foe the keychain password.

I believe you've surfaced the real issue – there's no confirmation prompt that requires the keychain password.

Re: Security Flaw in OS X displays all keychain passwords in plain text

#19

Post by zZorgz »

So there's gonna be arguments both ways whether or not this console command should ask for a password or not since the user is already logged in.

The main concern I have is the inconsistency that this command does not request a password while the keychain access app, as far as I know, does request one.

Apple has been aware about their security behavior here at any rate.

Post reply on HN