1

How would one extract a non-exportable private key in Mac OS X 10.12.4?

Improve this question
0

1 Answer 1

Reset to default
3

Plenty of tools for this, I'll leave this here: https://github.com/n0fate/chainbreaker but Elcomsoft and other folks sell pretty versions ostensibly for law enforcement purposes.

The non-exportable flag for most keychains is typically a simple UI limitation not an actual security feature. Which means it needs to be stored/extracted into memory at some point. This is one behavior we can take advantage of.

It's a known limitation of most implementations of keychains/certstores etc. This is changing as operating systems begin to take advantage of TPMs for hardware backing of keychains. (For example, you cannot do this on ChromeOS: https://www.chromium.org/developers/design-documents/tpm-usage)

Improve this answer
3
  • Thanks for your answer, slightly off topic, which tool do you recommend to extract the memory image (and format)?
    – stealthmode
    Apr 19, 2017 at 16:57
  • github.com/volatilityfoundation/volatility has recently updated with symbols to support 10.12.4 you'll need to get the latest but it should work.
    – Ori
    Apr 19, 2017 at 17:23
  • Thank you, there are several options in this framework. Could you please let me know the commands that I'd need to run to acquire the memory dump for volafox?
    – stealthmode
    Apr 19, 2017 at 17:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .