6

Apple uses a nice keychain. This is used by, for example, Google's Chrome browser.

Imagine a user copies all the keychain files.

Would that user be able to unlock the keychain, if they knew the master password, on a different Mac computer running the same version of OS X?

Does any software exist to allow a user (who remembers their master password) to open the keychain on Windows or Linux?

Have any vendors attempted brute force or dictionary attacks? (I checked Elcomsoft, and they don't appear to have a Mac Keychain product yet.) I understand that these attacks are unlikely to be successful if the user has chosen a good password, but I also know that most people do not chose good passwords.

1

2 Answers 2

3

It is possible to open the keychain file provided that you have the password associated with it (usually, but not always the user's login password).

I have personally done this when backing up and performing a manual upgrade of my personal system, although I do not know where any software is available to open the file out of Mac OS.

1

Yes, macOS keychain files can be opened and decrypted on other computers. The underlying keychain format is included in Apple's open source code for Darwin. Knowing this, brute force and dictionary attacks are both possible given a keychain's master password hash.

To brute force or dictionary attack a non-System Keychain file, you only need the Keychain file. Use a tool like my Keysafe tool, or another script, to extract the master password hash from the Keychain file. The final hash should be in form:

$keychain$*salt*iv*ciphertext

Pass this hash to hashcat or JtR to perform the attack.

The complete sequence is:

keysafe -recover -path sample.keychain > keychain-hash.txt
sed 's/^[^:]*://' keychain-hash.txt > for-hashcat.txt
hashcat -m 23100 --keep-guessing for-hashcat.txt dictionary.txt
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .