Just as macOS High Sierra, security researcher Patrick Wardle tweeted a previously undisclosed (zero day) vulnerability in Keychain, Apple's secure credential repository. The vulnerability potentially affected a wide range of macOS versions. Apple has since mitigated the issue with a Supplemental Update, now available via the Mac App Store.
on High Sierra (unsigned) apps can programmatically dump & exfil keychain (w/ your plaintext passwords)🍎🙈😭 vid: https://t.co/36M2TcLUAn #smh pic.twitter.com/pqtpjZsSnqon High Sierra (unsigned) apps can programmatically dump & exfil keychain (w/ your plaintext passwords)🍎🙈😭 vid: https://t.co/36M2TcLUAn #smh pic.twitter.com/pqtpjZsSnq— patrick wardle (@patrickwardle) September 25, 2017September 25, 2017
Wardle said he could put a malicious app on someone's Mac and then use that app to get around Keychain's security and pull out usernames and passwords programmatically.
That meant Wardle, or someone using the same exploit, would have to use a phishing attack or some form of social engineering to get the malicious app onto your Mac, then use that malicious app to go after your Keychain.
In the Supplemental Update, Apple offered the following mitigation:
A method existed for applications to bypass the keychain access prompt with a synthetic click. This was addressed by requiring the user password when prompting for keychain access.
The Keychain vulnerability, while bad and requiring this's fix, wasn't something macOS users needed panic about. At least not those used to following the same security best practices everyone in the industry has been talking about for years.
Namely, those that kept Apple's default Gatekeeper settings enabled and didn't download anything, or click on any links, they don't absolutely trust.
macOS is more open by design than iOS. Malicious apps have targeted trusted developers and even tried to get into the App Store through third-party code. They get found. They get fixed.
As the Mac's popularity continues to grow relative to the industry, it makes the economics of attacking Mac users more attractive to hackers.
Multi-layered defense-in-depth, from prevention to detection to removal, is the best way to keep ahead of new threats and handle newly discovered ones.
Firmware integrity protection, anti-malware, system integrity protection, Gatekeeper, and other services are how Apple is implementing defense-in-depth.
Since no code is perfect, exploits will keep coming up. So, what matters is how fast and well Apple — or any vendor — responds to exploits.
Download and install the Supplemental Update for macOS High Sierra as soon as possible and continue to keep informed and keep safe.
