Apple’s operating systems have recently had more than their fair share of serious security issues, and the latest problem will be enough to rattle millions of Mac users. Previously credible researcher Linuz Henze has revealed an exploit that in one button press can reveal the passwords in a Mac’s keychain.
Keychain is where macOS stores most of the passwords used on the machine, ranging from iMessage private encryption keys to certificates, secured notes, Wi-Fi, and other Apple hardware passwords, app passwords, and web passwords. A pre-installed app called Keychain Access enables users to view the entire list of stored items, unlocking each one individually by repeatedly entering the system password, but Henze’s KeySteal exploit grabs everything with a single press of a “Show me your secrets” button.
Henze demonstrates KeySteal in a YouTube video (via 9to5Mac) depicting the latest public version of macOS Mojave, 10.14.3, but says that the exploit also exists on earlier versions of macOS. While the demo is run on a 2014 MacBook Pro without Apple’s latest security chips, Henze says that it works “without root or administrator privileges and without password prompts, of course.” It appears to work on the Mac’s login and system keychains, but not iCloud’s keychain.
Generally, white hat security researchers publicly reveal flaws like this only after informing the company and giving it ample time to fix the issues. But Henze is refusing to assist Apple because it doesn’t offer paid bug bounties for macOS, one of several disincentives for researchers who might otherwise assist the company.
June 5th: The AI Audit in NYC
Join us next week in NYC to engage with top executive leaders, delving into strategies for auditing AI models to ensure fairness, optimal performance, and ethical compliance across diverse organizations. Secure your attendance for this exclusive invite-only event.
Even on iOS, where Apple does offer bug bounties, the process for submitting bugs to the company is overly complex and dilatory — an issue spotlighted in the recent FaceTime spy bug debacle. Researchers have also accused Apple of hiding notices of bug fixes in sneaky ways and of taking too long to address reported issues, even when the security or privacy implications are serious.
Henze does not appear to be interested in releasing full details of the exploit so that other hackers might use it, but he notes that a similar hack was revealed by Patrick Wardle in 2017 for macOS High Sierra. Apple fixed that bug, but KeySteal has the same ability to steal all of a keychain’s passwords, just through another method.
