High Sierra 安全隐患: 应用程序可以访问钥匙串并收集密码

[Chingim]

Patrick Wardle, Synack ’ s head of research, posted a video on Monday that shows how code he wrote can be used to get passwords from macOS ’ s Keychain. Keychain is the password manger built into macOS, and it usually requires a master password to access it. But Wardle ’ s code was able to access Keychain and collect passwords.

source

[0xcb]

之前版本都可以的啊，只要你授权管理员帐户，dump keychain 简单的很

[Chingim]

@0xcb 不用授权

[bkmi]

按理说这应该是个大新闻，但是竟然没人关注的，神奇神奇

[Chingim]

@bkmi macOS 的关注度是没有 iOS 的高, 大家普遍更加关注升 iOS 11 卡不卡, 耗电有没有增加.

[bkmi]

@Chingim 首页还一堆讨论升级的呢

[tairan2006]

…这个很严重啊，还升什么级。。

[usedname]

这个 bug 没人关注？

[BearD01001]

持续关注...

[NVDA]

看到了，原作者说给 Apple 发邮件了但是没有回应，我也好奇这明明就是个大新闻为什么没人发...

[wuhao930301]

手动关注。为什么 Beta 版的时候没曝出来，是正式版才有的 bug 么

[Chingim]

@wuhao930301 小人之心地不负责任地推断, 这漏洞估计早就发现了, 就等苹果发布正式版吧

[onevcat]

https://twitter.com/patrickwardle/status/912254053849079808

这个吧？看起来是一直就有的吧，作者也说“ other versions of macOS are vulnerable too ”

只有 unsign app 能干这事儿，没签名或者签名不对的 app 别用就是了..

[warking]

Correction: The exploit affects other macOS versions too, including the latest High Sierra, but is not specific to the latter only. Apple has actually fixed a number of critical security flaws with macOS 10.13 making it an important update.

http://wccftech.com/macos-high-sierra-hackers-steal-passwords/