Hahahahah, I watched the two videos. More bs meant to scare Apple users. This is pathetic and barely an exploit at all. A 12 year old could figure these out in an afternoon. Apple doesn't even need to fix this. That's how pathetic these "exploits" are.
Laughable "Exploit" #1:
* A malicious app tells Keychain Access to store a "blank" password for a site (like Facebook.com), with access rights by both Google Chrome/Safari/Whatever browser, *and* the evil app.
* The user logs in to the site and tells their browser to save the password, which puts the real (non-blank) password in the Keychain.
* Since the evil app created the keychain entry, it still has access to read it and can see the real password.
* This exploit requires that the malicious app knows your website login username/email already, so that it can create a dummy entry with the correct login name, so that the browser will update that exact Keychain Access entry with the password.
* This exploit only works if there's NOT ALREADY a password entry stored for that site. If there's an existing entry, it cannot overwrite it/add itself as access to it without triggering OS X's "allow this app to access Facebook.com in your keychain?" dialog, which means almost nobody will be hit by this exploit since most people have already stored their passwords.
* This is not a flaw of Keychain Access. It's working as intended: Allowing more than one app to access keychain access entries. Although Apple *might* want to lock it down so that apps can only add themselves (not other apps) to the access list. If so, it would be impossible for a malicious app to add the browser to the access list of the dummy/blank login. Although this would just cause the browser to trigger the "allow the browser to access Facebook.com in your keychain?" dialog, and most people would accept that, so it wouldn't really solve the problem. And as mentioned, it's an extremely minor problem and requires that the exploit knows your email/username for the site *and* adds the Keychain Access entry *before* the browser has added any. For most users, they will already have entries for all sites they use, so the malicious app can't do jack sh$t. And again: A malicious app needs to know your exact email/username as well, which is already extremely unlikely.
* Lastly: 1Password does not use Keychain Access. At all. Use that password manager instead. It's also far more portable, working on Windows and iOS as well, and has Dropbox sync. And of course it lets you store all kinds of other useful, secret data, like Software Licenses.
Laughable "Exploit" #2:
* A malicious sandboxed app is able to read files from other sandboxed apps. The researchers call this "cross-app resource access" or XARA for short.
* (Not shown in the video, but far more serious) A malicious non-sandboxed (non-App Store) app can read any file the user owns on the filesystem.
* When you can read files on their system, you can of course steal secrets from other apps.
* This is not a problem: 1Password's secrets are encrypted. I would happily email my entire 1Password database to the NSA. Having the database is worthless if they don't also have the password, and my password takes hundreds of trillions of years to crack, so not even the NSA can do it (*period*; it's mathematically impossible even if they had ten thousand working quantum computers).
* What is a problem is that malicious apps can steal unencrypted user files and send them away. But that's always been a problem on every OS ever. Don't install/run weird software.
* As for sandboxed apps: Yes, Apple should fix it so that sandboxed apps can't read each other's data directories. But it's a very minor issue. Your system is already no-doubt full of non-sandboxed software, and *that* software has access to the *whole* filesystem. A sandboxed (App Store) app only has access to its sandbox and the sandboxes of other App Store apps.
Laughable "Exploit" #1:
* A malicious app tells Keychain Access to store a "blank" password for a site (like Facebook.com), with access rights by both Google Chrome/Safari/Whatever browser, *and* the evil app.
* The user logs in to the site and tells their browser to save the password, which puts the real (non-blank) password in the Keychain.
* Since the evil app created the keychain entry, it still has access to read it and can see the real password.
* This exploit requires that the malicious app knows your website login username/email already, so that it can create a dummy entry with the correct login name, so that the browser will update that exact Keychain Access entry with the password.
* This exploit only works if there's NOT ALREADY a password entry stored for that site. If there's an existing entry, it cannot overwrite it/add itself as access to it without triggering OS X's "allow this app to access Facebook.com in your keychain?" dialog, which means almost nobody will be hit by this exploit since most people have already stored their passwords.
* This is not a flaw of Keychain Access. It's working as intended: Allowing more than one app to access keychain access entries. Although Apple *might* want to lock it down so that apps can only add themselves (not other apps) to the access list. If so, it would be impossible for a malicious app to add the browser to the access list of the dummy/blank login. Although this would just cause the browser to trigger the "allow the browser to access Facebook.com in your keychain?" dialog, and most people would accept that, so it wouldn't really solve the problem. And as mentioned, it's an extremely minor problem and requires that the exploit knows your email/username for the site *and* adds the Keychain Access entry *before* the browser has added any. For most users, they will already have entries for all sites they use, so the malicious app can't do jack sh$t. And again: A malicious app needs to know your exact email/username as well, which is already extremely unlikely.
* Lastly: 1Password does not use Keychain Access. At all. Use that password manager instead. It's also far more portable, working on Windows and iOS as well, and has Dropbox sync. And of course it lets you store all kinds of other useful, secret data, like Software Licenses.
Laughable "Exploit" #2:
* A malicious sandboxed app is able to read files from other sandboxed apps. The researchers call this "cross-app resource access" or XARA for short.
* (Not shown in the video, but far more serious) A malicious non-sandboxed (non-App Store) app can read any file the user owns on the filesystem.
* When you can read files on their system, you can of course steal secrets from other apps.
* This is not a problem: 1Password's secrets are encrypted. I would happily email my entire 1Password database to the NSA. Having the database is worthless if they don't also have the password, and my password takes hundreds of trillions of years to crack, so not even the NSA can do it (*period*; it's mathematically impossible even if they had ten thousand working quantum computers).
* What is a problem is that malicious apps can steal unencrypted user files and send them away. But that's always been a problem on every OS ever. Don't install/run weird software.
* As for sandboxed apps: Yes, Apple should fix it so that sandboxed apps can't read each other's data directories. But it's a very minor issue. Your system is already no-doubt full of non-sandboxed software, and *that* software has access to the *whole* filesystem. A sandboxed (App Store) app only has access to its sandbox and the sandboxes of other App Store apps.
Last edited:
