Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

On OS X, when an application requests access to a Keychain item, the user is prompted whether to grant or deny that access.

Supposedly, the system saves not only the binary path, but also its hash in the ACL entry that is created after the user confirms the request; according to Apple, this protects against modified binaries gaining access to user passwords and/or certificates.

Is this really sufficient to prevent an attacker with user (but not superuser) permissions from retrieving all stored passwords?

On Linux, for example, there is the environment variable LD_PRELOAD which can be used to load additional dynamic libraries that overwrite some standard library functions with custom code; using that, it would seem to be possible to change the code that is executed within a given binary without modifying the base executable itself.

Is there a similar mechanism on OS X that would enable such an attack (maybe one of the methods mentioned here)?

share|improve this question
    
It is pretty secure in my opinion, It was initially part of the apple email system power talk but fell apart. Apple has always been secret on what encryption schemes they use but its not easy to retrieve passwords from keychain –  Neeraj Saini Jul 30 at 12:23

2 Answers 2

The security boundary is root, i.e. securityd running as root. If securityd and it's ACL are implemented correctly, there is no way for another application to access the key from the keychain. However, Mac OS X has had several privilege escalation vulnerabilities which would allow a local user attacker to access securityd and thus the item from the keychain. It is reasonable to assume that a moderately/highly skilled attacker could still find existing privilege escalation 0day.

share|improve this answer

for all of we know, OSX's developer try really hard to protect and encrypt the data in the keychain, and like other applications (firefox, even windows auth's), you can access it with a password, the only real attack that would work at the moment, is either keylogging when accessing such thing as a keychain, or by bruteforcing/dictionary attack the "password" field, since those aplpications do not have a "lockout" function after i.e. 5 tries in 1 minute

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.