Questions tagged [macos]

macOS (formerly Mac OS X and OS X) is a series of Unix-based graphical interface operating systems developed, marketed, and sold by Apple Inc.

61 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
260 views

Doing builds in a sandbox

I'm keen to start allowing people to build Electron apps on my cloud infrastructure. On Linux the security I'm employing is with throwaway Docker containers. I know it's not 100% secure but it's ...
user avatar
3 votes
0 answers
644 views

GPG Agent SSH Forward Pinentry

I have GPG agent forwarding via SSH RemoteForward working up to a point. I can list my private and public keys on the remote host. If I try to decrypt a file remotely, the PIN is prompted for but the ...
user avatar
3 votes
0 answers
227 views

Capture macOS/IOS system HTTPS packets

I tried to analyze the https traffic of apps on my MacBook and iPhone with Charles with SSL proxy (I use HTTP proxy for IOS and installed and trusted Charles certificate). I managed to decrypt most ...
user avatar
  • 31
3 votes
0 answers
199 views

macOS Data Protection without FileVault

I'm running macOS 10.14, and have encountered a problem which prevents me from enabling FileVault. As best as I can determine, there are no free and convenient alternatives for full disk encryption, ...
user avatar
3 votes
0 answers
117 views

Does Apple have access to the cryptographic keys to decrypt Safari Sync Data?

I was reading over iOS's security guide, and it is unclear to me whether Apple can accessed synced Safari data. For example, if Apple received a FISA Order for all information on iCloud on all ...
user avatar
3 votes
1 answer
157 views

How to enforce on the OS level to recognise only certain keyboards

I give employees AES wireless keyboards. I would like to enforce the OS to only recognise the keyboard we supply. Is that possible? Assuming my employees OS are Windows 10, Ubuntu, Mac OSX. How could ...
user avatar
3 votes
1 answer
444 views

OS X 10.6 and known unpatched vulnerabilities

Apple is not renowned for publishing clear end-of-support announcements for their products. In our network (a big university) we have strict policies and we do not allow unpatched systems. We were ...
user avatar
  • 672
3 votes
1 answer
137 views

Least riskiest option when it comes to reinstalling the OS

I understand security is a continuum rather than a binary, which is why I'm asking this question. I need to reinstall the OS on my Macbook. However, after a security mishap, I’m far more alert about ...
user avatar
  • 531
2 votes
1 answer
258 views

How to verify a x509 certificate from Apple on a Ubuntu server?

I'm trying to verify GameCenter authentication on an iOS app with GameKit. The fetchItems API returns a URL for the public key needed to do this. Steps 3 and 4 of that API say: Use the publicKeyURL ...
user avatar
2 votes
1 answer
1k views

Bitwarden and gamecontrollerd on OsX Big Sur

Recently, I came across an issue concerning a daemon named gamecontrollerd in OsX Big Sur. On my laptop I'm running ReiKey (from Objective-See), which aims at identifying possible Key Loggers that ...
user avatar
2 votes
0 answers
116 views

Log/Detect Clipboard access

With the public beta access to iOS 14 people got a warning when apps access the clipboard, and it lead to people realizing that many apps just grab everything from the clipboard they can get and send ...
user avatar
2 votes
0 answers
131 views

What potential security issues running sandboxd as root?

I have noticed that MacOS is running its sandbox process under the root user. This implies that any sandboxed process, assuming that it can escape the sandbox, would then have root privileges. Am I ...
user avatar
2 votes
0 answers
655 views

Native OS X sandbox profile to control network access (IP/host-based)

On Mac OS X, is it possible to limit an application's accessible hosts by using sandbox-exec? I can easily do it via a firewall app, but I would prefer to do it via the native sandbox mechanism in ...
user avatar
  • 21
2 votes
0 answers
7k views

SSL self signed certificate CER exception added to Keychain but fails in Chrome

Operating System: Mac OSX El Capitan 10.11.5 When browsing to the page I have a Privacy error, although an exception was added. I have the correct CER file so I added it to my Keychain TRUST THE CERT ...
user avatar
  • 161
2 votes
0 answers
207 views

Was the OSX/iOS Airdrop flaw real?

One exploit has caught my eye, mainly due to the possibility of malware incorporating it infecting businesses and schools. This exploit is, as you may have guessed from the title, the OSX/iOS Airdrop ...
user avatar
2 votes
0 answers
128 views

Under what conditions does Safari have access to the Keychain?

The Keychain is shared among many different apple products and includes asymmetric, symmetric, and other types of security data. People who use iCloud, and also enable the keychain synchronization ...
user avatar
2 votes
0 answers
536 views

Is XSP suitable for Internet facing, production hosts? (either self hosted, as an Apache plugin, or FastCGI)

XSP is portable version of ASP.NET that allows for operation on OSX, Linux, and Windows. It's an alternative to IIS, and hosts its own web server, or can plug into existing web servers such as Apache....
user avatar
2 votes
0 answers
612 views

Does Mac OS X 10.8+ support self-signed Package Installer

I'm not sure whether self-signed Package Installer are supported by Mac OS X 10.8+ Using informations in How to create an Apple Installer Package Signing Certificate I could create a Package ...
user avatar
  • 21
2 votes
1 answer
264 views

Homebrew and NOPASSWD sudo

I like to be able to run some commands installed via Homebrew without typing my sudo password. The problem is that Homebrew installs everything with user permissions, so if I add the executables to ...
user avatar
  • 121
1 vote
0 answers
85 views

Need help cracking a MacOS Catalina password

I have found the hashes for the stored passwords on my mac, I do not have the administrator passwords, I do have the hashes coming from the /var folder. I have tried decrypting it using hashcat but it ...
user avatar
1 vote
2 answers
388 views

Safe or Unsafe to Store Passwords in Chrome on MacOS?

I've seen conflicting opinions on this, more than the below, but i.e. Unsafe: https://www.techrepublic.com/article/why-you-should-never-allow-your-web-browser-to-save-your-passwords/ Safe: https://...
user avatar
  • 302
1 vote
0 answers
98 views

Recovering files with recovery key after double FileVault activation - is that possible?

Let's imagine I have a work macbook with ssd and I use FileVault, and the company has the FileVault recovery key. I want to make sure my data is erased and unrecoverable, what is the best way to ...
user avatar
  • 153
1 vote
0 answers
110 views

Why does pycharm uses lax security on macOS?

When looking at entitlements on pycharm CE for macOS, it shows many serious security exceptions. Here are its entitlements: <dict> <key>com.apple.security.cs.allow-jit</key> ...
user avatar
  • 331
1 vote
0 answers
81 views

OSX: Momentary appearance of a .dmg modal, when opening an image

I had a situation that struck me as odd. I opened an image which I had downloaded via browser save-as. After the finder/OS initiated the file-open, a modal dialog momentarily flashed, typical to ...
user avatar
1 vote
0 answers
85 views

Increase password iterations?

Is it possible to strengthen the macOS login password by increasing the number of sha-512 iterations?
user avatar
1 vote
0 answers
63 views

Is it possible to open Chrome's databases.db in another MacBook?

According to this post, Chrome passwords are stored in /Users/$USER/Library/Application Support/Google/Chrome/Default/databases/Databases.db. Is it possible for an attacker to copy Chrome passwords ...
user avatar
1 vote
0 answers
422 views

Setup a meterpreter session trough a vpn

this is my first post here. I was trying to start a meterpreter session from a mac to my kali Linux machine trough a vpn but it isn't working. I downloaded openVPN config files from vpnbook.com and ...
user avatar
  • 111
1 vote
0 answers
682 views

On MacOS, which process is using nsurlsession to communicate over the network?

Since a few versions back (I guess it was 10.10 or 10.9) MacOS has this binary /usr/libexec/nsurlsessiond that accesses network on behalf of other processes. I believe this has to do with Apple ...
user avatar
  • 723
1 vote
0 answers
351 views

How is webrtc leaking IPs from behind a protocol agnostic, full VPN?

I am using the sshuttle VPN. It's NOT a browser plug-in or a simple proxy - it is a protocol agnostic, full VPN that sends all traffic out of any host you can ssh login to. It creates a bridge0 ...
user avatar
1 vote
0 answers
104 views

Employee home OSX laptop was stolen. How can I determine if the laptop was encrypted?

A non technical employee has had an OSX laptop stolen. 1) What technical approaches (iCloud verification) 2) What Questions should I ask the user to determine if the laptop was encrypted. (boot up ...
user avatar
1 vote
0 answers
141 views

Is this cascading encryption, and is my security weakened as a result?

I'm trying to understand what is, and what is not, considered cascading encryption. All of the posts and conversations I've read over the past few days discourage the practice, including this article. ...
user avatar
1 vote
0 answers
129 views

when/how does an encrypted volume .dmg change to reflect the file system it stores

I'm trying to verify that storing a .dmg file stays encrypted while only the mounted file system is unencrypted (see here). My thought was to create a .dmg containing a text file, make a copy of the ....
user avatar
  • 171
1 vote
0 answers
77 views

Why doesn't homebrew fix file access problems by itself?

Before I took ownership of /usr/local, "brew link" caused a "/usr/local/..." not writeable. Is there any particular security reason why the program didn't say something like "The operating system won'...
user avatar
1 vote
0 answers
2k views

How do I view the signature of an iOS application?

OSX had an issue where the certificate was expired and several apps could not be opened after that date. The command above illustrates how this could have been detected. Does iOS have a similar ...
user avatar
1 vote
0 answers
130 views

Is there an extension/command line for OSX Chromium to save website passwords in LOCALSTORAGE instead of the system's keychain?

My situation: I want to use a portable-app implementation of Chromium running on a removable drive, so I never leave any passwords stored on the kaychain of any computer I use. Portable Chromium is ...
user avatar
  • 161
1 vote
0 answers
89 views

To which extent are paid alternatives to Apple's Xprotect worth it?

Mac OS X ships with Xprotect, Apple's mechanism to detect and remove malware. System software security holes are patched decently quickly. In a world of fragmented, code-signed, sandboxed apps, what ...
user avatar
  • 207
0 votes
0 answers
13 views

Get encryption status of NAS TimeMachine disk

I’m writing a script to get the encryption status of Time Machine disks. I run defaults read /Library/Preferences/com.apple.TimeMachine.plist and grep for LastKnownEncryptionState. This works fine for ...
user avatar
  • 111
0 votes
0 answers
51 views

Can a Bluetooth device hack a phone it used to be paired to if the device was removed from the phone, but the device was not reset/cleared?

If a Bluetooth device, like a toy, smart toothbrush, or headphones etc. is paired to a phone or computer, and the Bluetooth device is sold/lost without resetting the device or any Bluetooth data on it,...
user avatar
0 votes
0 answers
23 views

Compromised machine. Should I create a partition or volume to install a clean OS?

My goal is to create a 100% clean environment where I can interact with cryptocurrencies. For that, I can partition my disk or I can create a volume. Which one should I prefer? Some context about the ...
user avatar
0 votes
0 answers
36 views

When I visit an http://gofile.me/ link, how much information to I provide to the NAS server owner?

There are files I need from a heavy NAS user and they've given me a link of the form http://gofile.me/xxxxx/xxxxxxxxx If my laptop running the Chrome browser in macOS is connected to the internet via ...
user avatar
  • 1,385
0 votes
0 answers
62 views

Suspicious MAC address when using personal hotspot (iPhone and MacBook Air)

Personal hotspot connection from iPhone 12 used on my MacBook Air. Under Settings - Mobile Data - Personal Hotspot (iPhone), I see 2 data usage components: 1.5 GB - MacBook 20.2 KB - A suspicious MAC ...
user avatar
0 votes
0 answers
26 views

Is it a security risk that macOS Keychain.db files are accessible by any process on the system?

This question might have an obvious answer but I think a clear explanation is a missing piece on the internet. Isn't it (or is it) a security risk that macOS's Keychain.db files located at ~/Library/...
user avatar
0 votes
1 answer
39 views

Read files protected with System Integrity Protection with sudo

I had a debate with a friend about the security model in new OS X versions. OS X El Capitan and newer have the System Integrity Protection security feature which protects aspects of the OS even from ...
user avatar
  • 583
0 votes
0 answers
644 views

How secure is OpenCore Legacy Patcher?

My MacBookPro doesn't get major updates anymore, but the hardware still works well. I came accross OpenCore Legacy Patcher, which allows to install recent versions of MacOs onto older macs through ...
user avatar
  • 101
0 votes
1 answer
61 views

Does MacOS Filevault + Mac hardware obviate lengthy login passwords?

Take the combination of an encrypted disk with a secure enclave chip that never exposes an internal Key Encryption Key and throttles or prevents too many password guesses. Seems to me that this should ...
user avatar
0 votes
1 answer
76 views

Postgres.app security on a Mac?

I'm wondering if there are any security concerns with installing PostgreSQL on a Mac using the app? https://www.postgresql.org/download/macosx/ I had a look at the data folder and it's owned by me ...
user avatar
0 votes
0 answers
67 views

How to get EvilOSX's Slowloris to work?

I was trying out the Slowloris Module of EvilOSX. I've also installed the Homebrew Apache server on my victim VM using this link. However, when I executed the module, I noticed some packets started ...
user avatar
0 votes
0 answers
98 views

Hybrid-Analysis.com indicates the website that my macOS system is contacting is likely malicious

Backstory: I just upgraded my MacBook from OS X 10.11.6 to the most updated version of macOS, 10.14.6 Mojave. I also have the Little Snitch network filter installed. I know nearly nothing about ...
user avatar
0 votes
0 answers
80 views

How Does it Work - User Authentication using Yubico Smart Card (Yubico PIV) on Mac

Background: I have setup my macOS Catalina so that I can authenticate my user account using my Yubico (set up as a Smart Card) and its PIN After setting this up I can see that there are now 2 ...
user avatar
0 votes
0 answers
125 views

MacBook Pro is Powered On but Locked. Is my VeraCrypt data Readable if Laptop Stolen?

Secenario Consider the case of a MacBook Pro with FileVault active. The computer is on and I'm properly logged on. I frequently need to access sensitive data located in text files on an encrypted ...
user avatar