Highly credible security researcher, Linus Henze has shared a new video in which he demonstrates a macOS Mojave exploit which can potentially access passwords stored in Keychain. He also stated that he will not be sharing his findings with Apple in protest. So let’s dive in to see some more details on the Keychain exploit.
Keychain Exploit On macOS Mojave Deoed By Security Researcher, Passwords At Risk
The security researcher is highly credible as he has shared numerous iOS exploits and vulnerabilities in the past. Henceforth, Henze has a good track record. Furthermore, the researcher stated that he will not share his findings with Apple in a protest. He is frustrated that Apple’s bug bounty program only take iOS into account and not macOS. This made him not to share further information on the Keychain exploit.
Check out the demo video embedded below for more information on the exploit:
The KeySteal demo app requires no administration privileges for the attack to proceed. Moreover, the attack is still imminent even if Acess Control Lists are set up or not. Furthermore, it doesn’t matter if the Mac has System Integrity Protection enabled or not.
The Keychain exploit will allow an individual to access all items in the ‘login’ and ‘System’ (Heise.de). The iCloud Keychain, on the other hand, is not likely to be affected as it stores data in a different manner If you want to protect your Keychain from any attacks, you can lock the login Keychain with an additional layer of security, like a password which is not set up by default. In addition, it isn’t easy as well as it requires lengthy security authentication dialogs on macOS.
Since the security researcher will not share his findings with Apple, it’s unclear at this stage whether the company is aware of the issue. Henze also wants other hackers to release security issues related to macOS publicly. This will ultimately pressure Apple into expanding its bug bounty program beyond iOS.
There will be more to the story, so be sure to stay tuned in for more details on the matter. This is all for now, folks. What are your thoughts on the Keychain exploit? Share your views with us in the comments.
The post Researcher Demos macOS Mojave Keychain Exploit To Access Passwords, Will Not Share Findings With Apple by Ali Salman appeared first on Wccftech.
Refference- https://wccftech.com
0 Comments