Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Boffins reveal password-killer 0days for iOS and OS X

theregister.co.uk

Post reply on HN
Print view View original

81–90 of 144 posts

Re: Boffins reveal password-killer 0days for iOS and OS X

#81

Post by webjprgm »

nadams wrote: post #54
mmcconnell1618 wrote: post #44

Earlier quoted context omitted.

Good thing there are 1,500,000 apps in the store and getting visibility is the biggest challenge for developers/publishers :-)

"MoneyMakingApp5000 - make money from home" Post some screenshots of the app with screenshots of some random Paypal transfers and I don't think that you will have a problem getting people to find/download your app.

Downloading and running it once would set up the exploit but not complete it, IIRC. You need to go back to the target app and re-enter credentials then run the exploit app a second time. So a broken app that a user would run once and then delete is no good.

A standard Trojan game/utility would work fine even if only a small number of people run it.

Re: Boffins reveal password-killer 0days for iOS and OS X

#82

Post by mikeash »

w8rbt wrote: post #59
opcvx wrote: post #47

Earlier quoted context omitted.

Where should the state be kept, on a server?

No where electronically. A simple word or phrase in the user's mind would do. Rather than being stored for later retrieval, complex passwords could be generated on-the-fly (when needed) using this word/phrase as input combined with other input such as URLs, hostnames, service names, etc.

What is fundamentally different between your suggestion and an approach where passwords are kept in a file that's encrypted with a password that's kept only in the user's mind?

In both cases you have a bunch of data that mostly represents the passwords, but you need one final component to actually unlock it, which is the master password. What's the advantage of your proposal?

Re: Boffins reveal password-killer 0days for iOS and OS X

#83

Post by c0wb0yc0d3r »

jdc0589 wrote: post #73
drtse4 wrote: post #22

From the paper: > Since the issues may not be easily fixed, we built a simple program that detects exploit attempts on OS~X, helping protect vulnerable apps before the problems can be fully addressed. I'm wondering if the tool is publicly accessible, couldn't find any reference to it.

was wondering the same thing... finding items with more than 1 application is the important part. so this is a start: security dump-keychain -a > keychain.txt && egrep -n "applications \(([2-9] )\)" keychain.txt Then just look at the item that contains those line numbers and see whats up. You will have some show up on an unaffected system. This is what my output looks like: http://puu.sh/ishaP/675695b11e.png * discla…

Can you skip the whole writing to file bit, and pipe straight to egrep?

Re: Boffins reveal password-killer 0days for iOS and OS X

#84

Post by astrodust »

mmcconnell1618 wrote: post #44
DennisP wrote: post #31

Earlier quoted context omitted.

Yes, but the researchers submitted an app with the exploit to the app store, and it was accepted.

Good thing there are 1,500,000 apps in the store and getting visibility is the biggest challenge for developers/publishers :-)

Security through obscurity strikes again!

Re: Boffins reveal password-killer 0days for iOS and OS X

#85

Post by jdc0589 »

c0wb0yc0d3r wrote: post #83
jdc0589 wrote: post #73

Earlier quoted context omitted.

was wondering the same thing... finding items with more than 1 application is the important part. so this is a start: security dump-keychain -a > keychain.txt && egrep -n "applications \(([2-9] )\)" keychain.txt Then just look at the item that contains those line numbers and see whats up. You will have some show up on an unaffected system. This is what my output looks like: http://puu.sh/ishaP/675695b11e.png * discla…

Can you skip the whole writing to file bit, and pipe straight to egrep?

sure. but then you wouldn't have a file to go investigate the matched line numbers in.

Re: Boffins reveal password-killer 0days for iOS and OS X

#86

Post by Bud »

DennisP wrote: post #31
userbinator wrote: post #29

Earlier quoted context omitted.

It's not remotely exploitable --- it requires installing a malicious app ; that makes it far less severe than something that could be done through e.g. just visiting a webpage.

Yes, but the researchers submitted an app with the exploit to the app store, and it was accepted.

Yes, they submitted one app which was accepted. That app is now gone, you can bet. Can they continue to submit apps continuously which Apple will still accept? I doubt it. The story isn't clear on this.

Re: Boffins reveal password-killer 0days for iOS and OS X

#87

Post by Someone »

andor wrote: post #16

Quick summary of the keychain "crack": Keychain items have access control lists, where they can whitelist applications, usually only themselves. If my banking app creates a keychain item, malware will not have access. But malware can delete and recreate keychain items, and add both itself and the banking app to the ACL. Next time the banking app needs credentials, it will ask me to reenter them, and then store them i…

Malware apparently can also create items in advance as a sort-of honeypot for passwords.

For me, that is worse, as when "Next time the banking app needs credentials, it will ask me to reenter them" would occur, my reaction would be "I do not know my password; it's in the keychain" (for most services)

Re: Boffins reveal password-killer 0days for iOS and OS X

#88

Post by Bud »

josteink wrote: post #55
romanovcode wrote: post #49

Earlier quoted context omitted.

>Just like Windows. Strange thing eh? Not strange if you grasp the fact that malware is just a program that has elevated access. For me it was strange how can Apple market their system as virus-free. Now that's ridiculous.

Yes, to any techie the lie is obvious. I just wonder what the vast userbase of uneducated people (seniors, teen bloggers, ironically education institutions, etc) who moved over to macs because they bought the lie will feel when they too later discover that the promises were a lie. Because unlike Microsoft, Apple doesn't have a battle hardened OS where security has been worked on systematically, for over a decade. And…

There was no lie. It was true then, and is still clearly and obviously true now, that Mac users have a small fraction of the malware issues that Windows users have. The difference between iOS and Android is even more stark.

You're also hilariously wrong about Microsoft having a supposedly "battle-hardened" OS where security has been worked on systematically. OS X is based on BSD Unix, where security has been worked on since the 1970s, before Microsoft even existed. OS X itself is now 15 years old.

I administer hundreds of Macs and PCs. I can objectively state that the PCs have about 10-50x as much issues with malware as the Macs have, and those issues are more severe and affect users and admins more. Everyone who manages both Macs and PCs in the enterprise is well-aware of this.

Re: Boffins reveal password-killer 0days for iOS and OS X

#89

Post by smtddr »

gpvos wrote: post #21
davotoula wrote: post #20

Earlier quoted context omitted.

How can malware delete a keychain item if it is not on the ACL?

Apparently everyone can. That's the bug, or at least a big part of it. There is precedent for this, for example in the Unix filesystem permissions: to be able to delete a file, you need write access to its parent directory; the permissions of the file itself are not taken into account.

>>There is precedent for this, for example in the Unix filesystem permissions: to be able to delete a file, you need write access to its parent directory; the permissions of the file itself are not taken into account.

My mind has been blown. I can delete this .txt as the user "pikachu". I had no idea.

  pikachu@POKEMONGYM ~/tmp3/pikachuFolder $ ls -la
  total 8
  drwxrwxr-x 2 pikachu pikachu 4096 Jun 17 08:48 .
  drwxr-xr-x 3 pikachu pikachu 4096 Jun 17 08:48 ..
  -rw-r--r-- 1 root    root       0 Jun 17 08:48 gogogadgetarms.txt
  pikachu@POKEMONGYM ~/tmp3/pikachuFolder $
  pikachu@POKEMONGYM ~/tmp3/pikachuFolder $ rm gogogadgetarms.txt 
  rm: remove write-protected regular empty file ‘gogogadgetarms.txt’? y
  pikachu@POKEMONGYM ~/tmp3/pikachuFolder $ ls -la
  total 8
  drwxrwxr-x 2 pikachu pikachu 4096 Jun 17 08:52 .
  drwxr-xr-x 3 pikachu pikachu 4096 Jun 17 08:48 ..
  pikachu@POKEMONGYM ~/tmp3/pikachuFolder $

Re: Boffins reveal password-killer 0days for iOS and OS X

#90

Post by glasz »

they've known for half a year and still, just 2 weeks back, cook is cooking things up about their stance on encryption and privacy [0]. you've gotta love the hypocrisy on every side of the discussion. it's so hilarious that it makes me wanna do harm to certain people.

[0] http://9to5mac.com/2015/06/02/tim-cook-privacy-encryption/

Post reply on HN