5 ms·
More info on the malware: > The OSX/Keydnap backdoor is equipped with a mechanism to gather and exfiltrate passwords and keys stored in OS X’s keychain. The au
by Mahn 10y ago
More info on the malware:
> The OSX/Keydnap backdoor is equipped with a mechanism to gather and exfiltrate passwords and keys stored in OS X’s keychain. The author simply took a proof-of-concept example available on Github called Keychaindump. It reads securityd’s memory and searches for the decryption key for the user’s keychain. This process is described in a paper by K. Lee and H. Koo. One of the reasons we think the source was taken directly from Github is that the function names in the source code are the same in the Keydnap malware.
Source: http://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/ http://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malw...
- GirlsCanCode 10y agoB..b..bbut! I thought Macs were _secure by design_ and didn't get infected! Did they lie?
- danieldk 10y agoThis is why applications should use app sandboxing on OS X. And Apple should provide an option to reject (by default) any application that is not signed + sandboxed, rather than: anything, signed, or app store.
- aparadja 10y agoWow. I'm the author of keychaindump. Didn't expect to become a malware co-author.
- robk 10y agoSeemed pretty likely though don't you think?
- aparadja 10y agoI guess any security tools and scripts are bound to be used for naughty stuff at some point, but I thought "real" malware writers would put more effort (at least obfuscation) into their products. Keychaindump is a crude hacky PoC, and I honestly didn't expect it to get directly copy-pasted into "serious" malware.
- sitkack 10y agoEvolution doesn't work hard for no reason.