Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Boffins reveal password-killer 0days for iOS and OS X

theregister.co.uk

Post reply on HN
Print view View original

21–30 of 144 posts

Re: Boffins reveal password-killer 0days for iOS and OS X

#21

Post by gpvos »

davotoula wrote: post #20
andor wrote: post #16

Quick summary of the keychain "crack": Keychain items have access control lists, where they can whitelist applications, usually only themselves. If my banking app creates a keychain item, malware will not have access. But malware can delete and recreate keychain items, and add both itself and the banking app to the ACL. Next time the banking app needs credentials, it will ask me to reenter them, and then store them i…

How can malware delete a keychain item if it is not on the ACL?

Apparently everyone can. That's the bug, or at least a big part of it.

There is precedent for this, for example in the Unix filesystem permissions: to be able to delete a file, you need write access to its parent directory; the permissions of the file itself are not taken into account.

Re: Boffins reveal password-killer 0days for iOS and OS X

#22

Post by drtse4 »

From the paper:

> Since the issues may not be easily fixed, we built a simple program that detects exploit attempts on OS~X, helping protect vulnerable apps before the problems can be fully addressed.

I'm wondering if the tool is publicly accessible, couldn't find any reference to it.

Re: Boffins reveal password-killer 0days for iOS and OS X

#24

Post by huxley »

Oletros wrote: post #15
webdevsimon wrote: post #7

Earlier quoted context omitted.

How do you know they was aware if they didn't "not even communicating"?

According to the article, they were aware

This doesn't seem like something a quick patch can fix.

The section of the paper on mitigation suggests that it is non-trivial to correct without significantly re-architecting the app-OS relationship, if the paper is accurate, Apple is in a very difficult situation.

Re: Boffins reveal password-killer 0days for iOS and OS X

#25

Post by draugadrotten »

andor wrote: post #16

Quick summary of the keychain "crack": Keychain items have access control lists, where they can whitelist applications, usually only themselves. If my banking app creates a keychain item, malware will not have access. But malware can delete and recreate keychain items, and add both itself and the banking app to the ACL. Next time the banking app needs credentials, it will ask me to reenter them, and then store them i…

Is there a known exploit in the wild?

Mac Outlook have (for unknown reasons) been asking me for my domain password to store it into the keychain, the last week, which surprised me at the time.

Re: Boffins reveal password-killer 0days for iOS and OS X

#26

Post by jahnu »

zelos wrote: post #12
StavrosK wrote: post #8

"Boffins"? Isn't that rather dismissive, as in "oh, look at what those crazy boffins cooked up now!"?

It's tongue-in-cheek. The Register's style is basically a joke on British tabloid styles.

I don't think it's a joke. I think they actively approve of tabloid style journalism.

See Orlowski's rants on climate change for example.

Re: Boffins reveal password-killer 0days for iOS and OS X

#27

Post by cinquemb »

hhsnopek wrote: post #19
gchp wrote: post #18

Well, shit. Finally I feel justified for never (read: rarely) using the "Save password", feature in my web browser. Does anyone know if Apple have done anything towards resolving this in the 6 month window they requested? Slightly worrying now that this has been published without a fix from Apple. I don't really download apps very often on my Mac, but probably won't for sure now until I know this has been resolved. A…

You know this was bound to happen sooner or later. That goes for any encryption technology. Last pass was recently "hacked" as well. You can't trust any crypto tech ;)

In the age of crypto-peddling-as-a-service by large, small companies and individuals alike, as an end all be all to general opsec and the tradeoffs inherit in any decision making (as it is so often common to ignore such elephants in the room with one wave of the "trust the math" wands), It might just be more socially acceptable to just feign surprise :P

Re: Boffins reveal password-killer 0days for iOS and OS X

#28

Post by skrowl »

therealmarv wrote: post #3

So Apple was aware of this for 6 months and are doing NOTHING, not even communicating?! How serious do they take security and fixing it (at least within 6 months) ?

I'm surprised that you're surprised! After The Fappening and the SMS of doom (amongst many others), you can't still believe that Apple gives a sh*t about security, can you?

I mean, I understand that there are still a lot of Apple fans here at HN, but Apple's security has been a laughing stock of the industry for a while now.

Re: Boffins reveal password-killer 0days for iOS and OS X

#29

Post by userbinator »

therealmarv wrote: post #3

So Apple was aware of this for 6 months and are doing NOTHING, not even communicating?! How serious do they take security and fixing it (at least within 6 months) ?

It's not remotely exploitable --- it requires installing a malicious app; that makes it far less severe than something that could be done through e.g. just visiting a webpage.

Re: Boffins reveal password-killer 0days for iOS and OS X

#30

Post by yAnonymous »

therealmarv wrote: post #3

So Apple was aware of this for 6 months and are doing NOTHING, not even communicating?! How serious do they take security and fixing it (at least within 6 months) ?

Apple's stance on security is "fix it when there's an exploit" rather than "fix it when it's broken".
Post reply on HN