Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

macOS High Sierra Vulnerability Allegedly Allows Malicious Third-Party Apps to Access Plaintext Keychain Data

After reading some developers’ thoughts on High Sierra, my Spidey Senses have been telling me to wait until .1 or .2 before I update.

All of the quirks of this launch reinforce this. It just feels like Apple is behind the ball across the board this time around.

What are others finding who have already upgraded?
 
This isn’t a real big deal. Even if a developer’s app is signed it doesn’t mean they couldn’t do something surreptitious with keychain. All this means is that 1Password, or similar, is still the best choice.
 
  • Like
Reactions: BWhaler
Wasn’t this supposed to be the “bug fixing” release when Apple made everything solid?
 
BootsWalking said:
Viruses and malware have been distributed via well-known trusted apps before, such as Handbrake. Now what?
Click to expand...
If you’re running something from outside the App Store, it’s inferred that you trust the source of the content. If you are compromised as a result, then your trust with that source is broken. Well, AND you’re compromised now. It could happen with Sketch, with Rogue Amoeba, with any of them. The user accepts the responsibility once they bypass GateKeeper.
 
Unregistered 4U said:
If you’re running something from outside the App Store, it’s inferred that you trust the source of the content. If you are compromised as a result, then your trust with that source is broken. Well, AND you’re compromised now. It could happen with Sketch, with Rogue Amoeba, with any of them. The user accepts the responsibility once they bypass GateKeeper.
Click to expand...

Blaming users for a critical OS vulnerability doesn't make much sense, especially considering the entire reason for having an industry-standard platform is to encourage third-party app development.
 
HallStevenson said:
How is he a jerk ? He made YOU aware of an issue, which means YOU can hold off installing the software. Blame Apple, not him !
Click to expand...

Apple needs to fix this, however mistakes happen. It is common courtesy to go to Apple(or any software company) with what he had and first ask how long they need to fix the issues before he releases his findings OR at least tell them he going to release the information in X days. Unless he just found this bug today it is distasteful that he waited until the public release to disclose it.
 
  • Like
Reactions: MacsRuleOthersDrool
DblHelix said:
Would have been great if he contacted Apple before the OS was released. Just looking for attention. Jerk
Click to expand...
You're pathetic.
[doublepost=1506368532][/doublepost]
chucker23n1 said:
If he did contact Apple, surely he can provide a disclosure timeline. When did he tell them? When, if at all, did they respond? How much time did he give them? When did he decide to no longer wait and instead publish the vulnerability?

Everything else is irresponsible.
Click to expand...
Yeah. He's irresponsible.

Not the corporation with billions of dollars and countless employees.
 
  • Like
Reactions: symphara
DblHelix said:
Would have been great if he contacted Apple before the OS was released. Just looking for attention. Jerk
Click to expand...

Looking for a paycheck. In another screenshot I saw he had something like "bug bounty program ($$$)" on the screen with the dump running.
 
upload_2017-9-25_14-43-34.png
 
  • Like
Reactions: AleRod, MacsRuleOthersDrool, needfx and 4 others
redscull said:
You’re talking about a sandboxed app. This app is junk off the internet. It could do literally anything your user creds have the power to do.
Click to expand...

Even non sandboxed app should require 'admin' privileges (or sudo), prompting your user password.
 
Luckily I rarely download anything outside of the app store. I do take updates from Adobe and other well known companies. I think this is a good general reminder about downloading software and understanding/trusting the source of that software. Know the company you are downloading from and make sure they are a reputable company with a solid customer history.

It would be nice to have a log of applications that access the keychain and what they access. But also, would be nice to restrict access to the keychain for only your app (storing to and retrieving from) but then that is it. This goes for traveling to less traveled websites. Keep your travels to known websites. Helps reduce the amount of malicious attacks/information gather you get.
 
chucker23n1 said:
He made everyone aware of the issue, possibly without giving Apple time to fix it. Thus, he exposed people.
Click to expand...
You are presuming the bad guys aren't already aware of this issue. It exists in High Sierra, Sierra, and so on... Seems Apple has had years to find it and fix it !
 
  • Like
Reactions: AdonisSMU
sequential said:
1. Would have been even greater if Apple had ppl who found these kind of bugs themselves before release.
2. You don't know if he found this yesterday. But sure hate on the guy who might have prevented your bank account password from ending up in the wrong hands. Jerk.
Click to expand...

Well, you don’t protect people by releasing the exploit to the public. You give the offending party time to correct and then shame them if they dont
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back