macOS High Sierra Vulnerability Allegedly Allows Malicious Third-Party Apps to Access Plaintext Keychain Data

[GGJstudios]

This security hole has existed for years. Notifying the public of its existence without giving the vendor a chance to close it causes more harm than good.

That's a matter of opinion. The general public doesn't have the knowledge and ability to take some general information about a vulnerability and develop and deploy an exploit, and those very few who could don't need a news article to know about the vulnerability. On the other hand, the general public should be aware that the vulnerability exists, so they will exercise more caution when installing apps. I'd say that causes more good than harm.

 

[chucker23n1]

That's a matter of opinion.

Yes, it is, but it's also the consensus among security researchers.

The general public doesn't have the knowledge and ability to take some general information about a vulnerability and develop and deploy an exploit,

Correct.

and those very few who could don't need a news article to know about the vulnerability.

They clearly do. They didn't find the vulnerability in years. Now, however, they know there is one to look for.

On the other hand, the general public should be aware that the vulnerability exists, so they will exercise more caution when installing apps. I'd say that causes more good than harm.

That's difficult in practice. Do you install an update to Adium, Transmission, whathaveyou because it fixes bugs? Or do you avoid installing it because it may surreptitiously exploit this security hole?

 

[Irishman]

If you upgrade to High Sierra, the filesystem change is included. You can't update to HS without getting the new filesystem.

That doesn't make sense to me. In reading online, it seems that - in the beta - there was a checkbox in the update process whereby you could choose to change to APFS or not (See here - https://www.macobserver.com/tips/how-to/upgrade-mac-apfs-after-high-sierra/

Can anyone confirm whether that checkbox is still there in the final release?

Or, barring that, can anyone confirm whether or not the update installer automagically detects if your Mac has an SSD or not, and thus, whether or not to update to APFS?

Thanks!

 

[chucker23n1]

That doesn't make sense to me. In reading online, it seems that - in the beta - there was a checkbox in the update process whereby you could choose to change to APFS or not (See here - https://www.macobserver.com/tips/how-to/upgrade-mac-apfs-after-high-sierra/

Can anyone confirm whether that checkbox is still there in the final release?

The checkbox was removed in later betas. The command-line option is apparently still there.

Or, barring that, can anyone confirm whether or not the update installer automagically detects if your Mac has an SSD or not, and thus, whether or not to update to APFS?

Sure — if you have a Fusion Drive, it detects that and doesn't convert to APFS.

 

[Ebenezum]

That doesn't make sense to me. In reading online, it seems that - in the beta - there was a checkbox in the update process whereby you could choose to change to APFS or not (See here - https://www.macobserver.com/tips/how-to/upgrade-mac-apfs-after-high-sierra/

Can anyone confirm whether that checkbox is still there in the final release?

Or, barring that, can anyone confirm whether or not the update installer automagically detects if your Mac has an SSD or not, and thus, whether or not to update to APFS?

Thanks!

If your Mac has a SSD it will be automatically converted to APFS, you don't have any choice. If it has Fusion or HDD it wont be converted.

https://support.apple.com/en-us/HT208018

 

[Irishman]

If your Mac has a SSD it will be automatically converted to APFS, you don't have any choice. If it has Fusion or HDD it wont be converted.

https://support.apple.com/en-us/HT208018

Thank you, Ebenezun. This lets me know that I am safe to update to HS.

 

[DevNull0]

Precisely! If their driver requires you to allow that company access to privileged areas of your system to use it, then when you allow it, it should be with the understanding of the risks. If the risk is not understood (and generally it’s not) then it generally shouldn’t be done. There are companies making millions and billions of dollars every year without requiring admin rights for an installation (both hardware and software), so it far more the rule rather than the exception.

Or maybe the chipmaker can't be bothered jumping through silly hoops to have their driver in the app store. This particular driver (for the CH340) doesn't need admin rights. But with the software, when I attach their chip to the mac's USB port, it shows up in MACOS as a virtual serial port. Then I connect whatever hardware I want to that serial port. Hardly a major security risk.

Either way though, your post really surprises me. I had no idea there are people who *want* one company to tell them what they can and can't run on their own computer and believe running arbitrary code on your own computer "generally shouldn't be done".

The risks of installing software from trusted sources is miniscule. I have suffered far more from Apple (and actually MS) created software than any malware. There was a version of iTunes where if you had more than one HDD partition, a bug in iTunes installer would delete the partitions, create one big partition and format it; wiping out your entire system. And MS-DOS 6.2 had a full HDD compression feature that had a bug where it would wipe out your entire HD.

Those are the only 2 times I've had catastrophic data loss -- both caused by the OS vendors own bugs (and both times I had good backups fortunately). I have never lost data to malware despite running tons of non-Apple-approved software.

For work, I need to play audio files of courtroom proceedings; it's a proprietary software package the government uses, but they provide a free player, even for Mac -- and it's not in the App store. IMO, there is literally zero reason to even own a Mac if I could only run software in the app store.

 

[Stella]

Or, more likely and probable: it is technically impossible, and / or commercially unviable to adapt applications to suit Apple's App Store guidelines.

Maybe if the AppStore was the only way of obtaining apps, developers would write code in a compatible fashion? Right now, there is no incentive for them to change their way of thinking/ programming.
[doublepost=1506468815][/doublepost]

 

[BigRob23]

Hi everyone, sorry for this silly question but I am fairly new to Mac OS. So since this bug thing can probably happen in other versions of OS, should I just update to High Sierra then? or should I wait for a patch ? thank you.

 

[GGJstudios]

Hi everyone, sorry for this silly question but I am fairly new to Mac OS. So since this bug thing can probably happen in other versions of OS, should I just update to High Sierra then? or should I wait for a patch ? thank you.

There's no advantage or disadvantage in waiting to upgrade, since the issue exists on your current version of macOS. Just be careful about installing apps from outside the Mac App Store and you should be reasonably safe.

 

[BigRob23]

There's no advantage or disadvantage in waiting to upgrade, since the issue exists on your current version of macOS. Just be careful about installing apps from outside the Mac App Store and you should be reasonably safe.

alright that sounds good then, I appreciate the help. thank you!

 

[theotherphil]

Or, more likely and probable: it is technically impossible, and / or commercially unviable to adapt applications to suit Apple's App Store guidelines.

It would be commercially viable if that was their only option.

 

[Stella]

It would be commercially viable if that was their only option.

Actually it wouldn't. Think cross platform applications: Just drop the Mac version, keep Windows and Linux versions. Maintaining a native Mac version may be too costly. Anyway, you'd still have the technical issues: some applications cannot abide by Apple's App Store rules. Plain and Simple! Its not a case of just "re-thinking of how its written", i..e., good example the sandbox requirements.

 

[Hater]

I like that the password is "hunter2", nice little bash.org reference there!

 

[djcristi]

it's this related? it poped up today.

 

[chucker23n1]

it's this related? it poped up today.

Hard to say. That one probably just contains equivalent security updates to those 10.13.0 did. But given that it says "public beta", maybe it includes this fix already?

 

[Synchrone]

Would have been great if he contacted Apple before the OS was released. Just looking for attention. Jerk

He did:

Wardle reported the vulnerability to Apple last month and decided to make the disclosure public when the company released High Sierra without fixing it first.

Who's the jerk now?

 

[docfuz]

Incredible.
Not the bug. Not Apple.
The comments. They are incredible, to say the least. But to each their own.

Yes, Sierra is vulnerable as well. Probably others (I wouldn't stretch it to all others).
No, signed apps do not protect from this. They simply are allowed to run without asking to explicitly permit it. This Patrick clearly stated in the first flow of comments to his tweet that he presented the non-signed case to show how low the bar is.

Since there is no real PoC or low level technical digression, it's still a 0-day. If it is and he really contacted Apple and a fix is coming, it's better for people to know. If somebody knew before him, and the exploit has been circulating before, it's difficult to imagine that people posting nonsense in macrumors forums (or wherever) could really have discovered their credentials been exfiltrated like that.

Between 1995 and 2001, (real) responsible disclosure was a reality. Bugs were discussed, exploits were analyzed and some of the blackhat community actively participated in the discovery/disclosure/resolution process. Then, when the public nonsense began to talk about (their) ethics, this process slowly died and it began the era of friday's advisories - void of any real technical discussion - and of automatic updates. The blackhat community readily began to, again, work in the dark without really disclosing. 0-days began to, again, stay in that state for, potentially, years. Look a years-long window of vulnerability and imagine it deteriorating your private data and life. You will probably change your idea about this guy. At least, a little bit, maybe sparing the other us about jerks, ethics and technical inaccuracies (that everyday let the bad guys behave as such and with profit).

Sorry for being rude. It's not you. This is for looking just at the finger, pointing to the moon.

 

[Unregistered 4U]

Or maybe the chipmaker can't be bothered jumping through silly hoops to have their driver in the app store.

I don’t know if the App Store supports “drivers” anyway, I believe it’s more of an app thing.

I had no idea there are people who *want* one company to tell them what they can and can't run on their own computer and believe running arbitrary code on your own computer "generally shouldn't be done".

Most people just want a “safe” computing experience. They’re not as concerned about how they arrive at that situation, they just want it. For any of the non-technically inclined people I support, primarily because I DON’T want to have to deal with the fallout, I tell them just download software from the App Store. The majority of the people I deal with don’t have to play audio files of courtroom proceedings, I’d imagine a vast section of the American populace doesn’t have to. BUT for those that do, they have the option to go around GateKeeper to do so.

The risks of installing software from trusted sources is miniscule.

Well, minuscule is fine as long as you weren’t one of the ones that had your system exploited by a trusted source (HandBrake or Transmit for example). And really, your average person that installs an exploit disguised a “money making opportunity” from a website has already shown an inability to gauge trusted sources... one of the reasons why they check is in place. For every one user that pauses when they see the dialog... before they do something that will turn their world upside down... then decides not to install... it end up being worth it.

 

[jeabraham]

Apple didn't fix the green button issue either, it still makes apps full screen and for some reason hides essential things like the dock and menu bar.

I recently learned you can double-click on the title bar to maximize most apps similar to the way the green button used to work.

 

[GGJstudios]

I recently learned you can double-click on the title bar to maximize most apps similar to the way the green button used to work.

There is no title bar in macOS. That's a Windows feature. Unless it changed drastically in High Sierra, double-clicking on the top bar (not the Menu bar) of most Mac apps will minimize/hide the window, not maximize it.

 

[chucker23n1]

There is no title bar in macOS. That's a Windows feature.

https://developer.apple.com/macos/human-interface-guidelines/windows-and-views/window-anatomy/

Apple begs to differ.

(Are you thinking of the task bar?)

Unless it changed drastically in High Sierra, double-clicking on the top bar (not the Menu bar) of most Mac apps will minimize/hide the window, not maximize it.

It’s configurable. See the Dock preferences.

 

[GGJstudios]

https://developer.apple.com/macos/human-interface-guidelines/windows-and-views/window-anatomy/

Apple begs to differ.

(Are you thinking of the task bar?)

I stand corrected. I'm thinking of the Title Bar in Windows that has the app title and the menu, which in macOS is consolidated in the Menu Bar which is shared by all apps.

It’s configurable. See the Dock preferences.

Did it change in High Sierra? Because in Sierra, you can't configure it to maximize by double-clicking the title bar. You can only select minimize or zoom.

 

[chucker23n1]

I stand corrected. I'm thinking of the Title Bar in Windows that has the app title and the menu, which in macOS is consolidated in the Menu Bar which is shared by all apps.

Right.

Did it change in High Sierra? Because in Sierra, you can't configure it to maximize by double-clicking the title bar. You can only select minimize or zoom.

Right. macOS has no notion of maximizing; never did and never will. They mean zoom.