Researchers Find Major Keychain Vulnerability in iOS and OS X 78
An anonymous reader notes a report from El Reg on a major cross-app resource vulnerability in iOS and Mac OS X. Researchers say it's possible to break app sandboxes, bypass App Store security checks, and crack the Apple keychain. The researchers wrote, "specifically, we found that the inter-app interaction services, including the keychain and WebSocket on OS X and URL Scheme on OS X and iOS, can all be exploited by [malware] to steal such confidential information as the passwords for iCloud, email and bank, and the secret token of Evernote. Further, the design of the App sandbox on OS X was found to be vulnerable, exposing an app’s private directory to the sandboxed malware that hijacks its Apple Bundle ID. As a result, sensitive user data, like the notes and user contacts under Evernote and photos under WeChat, have all been disclosed. Fundamentally, these problems are caused by the lack of app-to-app and app-to-OS authentications." Their full academic paper (PDF) is available online, as are a series of video demos. They withheld publication for six months at Apple's request, but haven't heard anything further about a fix.
Re: (Score:2)
You should try my Appchain app. It apps all your apps into one app. It even apps its own app into the app.
Yeah, but does it tech the tech? Everyone knows you need to be able to tech the tech to the warp drive to fix serious problems.
Re: (Score:3, Insightful)
Re: (Score:1)
Because some people think that their choice of phone says something about themselves, frankly choosing between the iPhone and a Galaxy is just having an F150 or a Silverado, its the exact same thing that millions of other people have. Much like the iPad/GalaxyTab/Surface, that product that diehards camp on the street for, covet in the corner of the coffee shop and define themselves by is the exact same product that brickies throw around on the jobsite, 12 years olds get in mass handouts at their schools and
Re: (Score:2)
In America, author uses analogy; In Soviet Russia, analogy uses author.
Yes, the F150 is popular. Yes, the iPad is popular. But the analogy ends there.
Re: (Score:2)
Yes, the F150 is popular. Yes, the iPad is popular. But the analogy ends there.
Kind of, but he's right: They are the most common, defacto choice because they are a good workhorse tool for the job. The Android world is full of choice - which can be a good thing - but if you aren't really fussed with that then you just get whatever everybody else has, which is an iPhone - it might be boring to do that but in that circumstance it's the logical thing to do...that's certainly what I did.
Re:That's Apple (Score:5, Insightful)
Granted, asking a researcher to not publish results is pretty lame. People have a right to know if they're vulnerable or not.
Re: (Score:2)
There is also regression testing. Done wrong, there are a lot of subsystems that will wind up broken.
I do agree that asking not to public results is lame, but I respect the researcher in heeding that, as KeyChain is a security critical element. I also understand that just hinting at a point of a vulnerability will get people going through things with a fine-toothed comb to find it.
So far, Apple seems to be doing OK when it comes to security. Even jailbreaks are history these days.
Re:That's Apple (Score:5, Insightful)
Maybe it is non-trivial to fix, but the lack of communication with the original author isn't good. Also, if something is going to take that long to fix the only reasonable thing to do is to publish an advisory so people can defend themselves. If this researcher found it, others can find it. If the only mitigation is to stop using the product, then you have to be honest and say that.
Re: (Score:2)
Re: (Score:3)
What they're complaining about is that they never heard back from Apple at the end of the six months. I'm sure that if Apple rang them up and said, "Hey, we're still working on a fix", that they'd have been willing to continue withholding publication. No mention of whether the researchers tried to contact Apple again at that time.
It's much better practice to allow a company to close a hole, than to inform users, who, in most instances, could do fuck all with that knowledge, anyway. On the other hand, there
Re: (Score:2)
users, who, in most instances, could do fuck all with that knowledge, anyway.
It is not that bloody hard to switch to another platform in the case of an OS flaw, or hardware vendor in the case of something like the Samsung keyboard hack. A hassle? Yes. But certainly not a case where a user "could do fuck all" at least now iOS and Samsung users can make an informed decision whether to take the risk of sticking with their device or move elsewhere.
On the other hand, there are other people who could make use of that knowledge, and that's who you want to keep in the dark
Which is why responsible researchers wait for a reasonable time before releasing their findings to the public, in this case they waited the 6
Re: (Score:2)
And seriously. How many of the apps you bought do you actually need? My bet, not as many you might believe
Re: (Score:2)
Six months is nothing to fully implement, test and roll out a fix.
if i got this right, the unauthorized cross-app resource access is a design flaw in the way different apps are allowed to interact. the apps are already out there. there is no fix unless you are willing to fix all affected apps as well, or break them.
this is a very serious issue and apple's silence and inaction is truly astonishing. at least some mitigation patch would be in place, asking the user's permission whenever any such interactions are about to happen.
Re: (Score:2)
In 2009, I alerted Apple to a major security flaw in their dev portal, in which anyone with an account could lock out admin access of any other account in the portal. I called their support hotline, and got a cocky rep from Ireland who assured me that no, such a thing was not possible, and that my understanding of the situation must be incorrect.
I wonder if they've ever fixed that issue, especially when they took the dev portal offline for a few months to fix other glaring security issues.
Re: (Score:2)
such as disallowing modification of system files regardless of an application's permission level.
So buggy insecure code somehow becomes secure if you can't modify it?
Re: That's Apple (Score:2)
Not being able to change libstdc++ may have its advantages.
Apple fans: Circle the wagons! (Score:1)
- "This could happen on Android, Windows and Linux, not just on Apple!"
- "It's only theoretical. It cannot happen in practice."
- "This is not how it works. It's because you don't know how to use your Mac/iPhone.."
Re: (Score:2)
- "This could happen on Android, Windows and Linux, not just on Apple!"
-
Um, It HAS happened on Android also: Critical flaws in Apple & Samsung Devices [krebsonsecurity.com]
No Keychain (Score:2)
Re: (Score:3, Interesting)
Take a look in your KeyChain to see what else it stores that you may not even know about. Logins for websites, for example.
Re: (Score:2, Insightful)
Apart from the 6 dozen wifi networks my laptop has connected to.
Safest place for any password is in your head, I even know all my cards off the top of my head.
Re: (Score:2)
Safest place for any password is in your head
Yeah when you're recuperating from a broken leg and you're all laced up with pain killers, you need to order stuff online because you can't get out, and you can't remember your password. How awesome is that?
Re: (Score:1)
I sometimes forget one and have to reset it via email, but my email and apple ID passwords are some of the strongest of all of them.
For one off accounts or sites I don't give a shit about I tend to choose trivial passwords, ironically they're usually the ones I forget.
Re: (Score:2)
That sounds like a perfect "edge case". It's incredible, though, the amount of people that heavily rely on auto-saved stuff.
Re: (Score:1)
Re: (Score:3)
Either your passwords are weak, or you're really smart. That doesn't help me. I have just too many passwords to manage. Firefox stores it's passwords separately, but I don't know how much that helps. The truth is you have to trust the machine and the people who make it. Yea, I know that sux.
Re: (Score:2)
Either your passwords are weak, or you're really smart. That doesn't help me. I have just too many passwords to manage. Firefox stores it's passwords separately, but I don't know how much that helps. The truth is you have to trust the machine and the people who make it. Yea, I know that sux.
Most, if not all of my passwords are 5 characters.
I simply take a four letter word like "farm" and a number and capitalise the first letter so it becomes "Farm4". Then I simply multiply that to meet complexity requirements and add a special character corresponding to the number if need be so it becomes something like "Farm4farm4", "Farm4$farm4$" or "Farm4farm4farm4farm4farm4" but all I need to remember is "Farm4" and how many times it is duplicated.
The problem with most people is that they trust expli
Email (Score:1)
Keychain keeps your email passwords. Based on that the hacker can have access to your entire web accounts: financial, shoppings, social media, etc. This reminds me to turn off iMessage's access to phone text messages to at least keep the sms secure from same attack vector. Most financial accounts has two factor verification.
Re: (Score:2)
No, it does not keep your email passwords if you don't use OSX to read your email.
Re:No Keychain (Score:5, Informative)
It's not just the built-in Keychain that's compromised. They've also managed to use these attacks to snoop on inter-process communication when they shouldn't be able to, such as that between the 1Password Mini extension that runs in the browser and the 1Password app that's responsible for the encrypted vault with all of a user's passwords. By doing so at the right time, they can capture any information exchanged between the two.
Of course, there are easier ways to capture that particular data, such as simply making a malicious browser extension that captures usernames and passwords. You could likely get better distribution by doing so, not to mention avoiding any scrutiny that might come from the review process for the Mac App Store or iOS App Store.
Even so, the fact that this is possible opens up a whole variety of attacks, many of which can compromise more significant amounts of data. For instance, they demonstrated an attack on Evernote that compromises all of the user's notes. Many people keep way too much sensitive information in Evernote, and an attack like this could really burn them.
Re: (Score:1)
The built-in keychain issue is that on the Mac each item's access is controlled by a ACL. Another app with a forged bundle ID (com.appdev.foo) co
Re: (Score:2, Informative)
I don't even use the keychain for anything other than wifi network passwords.
I don't use iOS at all, but I didn't see the point in posting just to tell everyone this.
Re: (Score:2)
n.
Re: (Score:2)
I don't even use the keychain for anything other than wifi network passwords.
I don't use iOS at all, but I didn't see the point in posting just to tell everyone this.
And yet you still did...
And they mocked windows for IAC ruthlessly... oh.. (Score:1)
"these problems are caused by the lack of app-to-app and app-to-OS authentications"
Re: Nesil Hosting (Score:1)
Hacks (Score:1)
Order of operations is important (Score:5, Insightful)
It looks like the attacking app needs to be run before the attacked apps have had a chance to put their own entries in keychain.
From their videos they run their "malware" first, setup an empty keychain entry for whatever it is they'd like the password for (eg. iCloud or facebook through chrome). Then they run the app in question which fills in the password into the earlier created keychain entry. Since the malware is the one who created the keychain entry, it has access to the password.
Definitely a vulnerability. But the attack window seems smallish. But, of course, that varies with a user's activities. If they setup their icloud when they installed (or first logged in) or before they did anything else then it looks like the malware can't do anything. But it still leaves a pretty big window.
I'm guessing that the "fix" would be for there to be no way to share passwords among apps.. or for an app to be allowed to specify that "this password is for me and me alone.. nobody else can have access to it". Non-trivial changes, I'm sure.
Definitely an ugly one.
Re: (Score:1)
I'm guessing that the "fix" would be for there to be no way to share passwords among apps.. or for an app to be allowed to specify that "this password is for me and me alone.. nobody else can have access to it".
Already there. The glossary for the documentation on Apple's site (at https://developer.apple.com/library/ios/documentation/Security/Conceptual/keychainServConcepts/glossary/glossary.html) has the following:
access control list (ACL)
A structure containing information describing what must happen (display a confirmation dialog, ask for a password, and so forth) in order to permit a specific operation to occur. An ACL may also contain a list of applications that are always trusted to perform that operation. Each keychain item has one or more associated ACLs, and each ACL applies to a single operation that can be done with that item, such as encrypting or decrypting it. See also access object.
Re: (Score:2)
Easy enough to spam the keychain with any of the "interesting" options.....if it's already there and fails, skip it, otherwise, the malware is prepped for a value getting added in the "YourBank" entry to whatever else.
Re: (Score:2)
Not only that, but apps can detect that happening and remove access from the malware before they save a password. The point is that most vendors don't bother looking at the access control list for keychain items. This is discussed in the developer docs for Keychain Access Controls.
Re: (Score:2)
Not quite. The attack is easily extensible so that the attackers can "run before" the target app at any time by simply deleting the keychain entry and recreating it with a new ACL that permits the target app and themselves access to the entry. From the user's perspective, they see an unexplained repeat prompt to enter their password which they'll gladly do and from there on, the attackers have access to the password.
These security holes are quite awful.
Every week now (Score:1)
Should Edward Snowden Trust Apple To Do the Right Thing?
http://yro.slashdot.org/story/... [slashdot.org]
What do you think?
Researchers Find Major Keychain Vulnerability in iOS and OS X
http://it.slashdot.org/story/1... [slashdot.org]
Re: (Score:1)
Re: (Score:2)
"The secret token of Evernote" would be a great RPG title.
... or a porn about a character named Evernote. (sorry about the repost, forgot to quote the parent in the original.)
"researchers?" (Score:1)
The cynic/conspiracy theorist in me wonders... (Score:1)