4 ms·

It doesn't seem like a real vulnerabilty to me - it is not remotely executable, it has to be run by a signed in user on the actual device. When you go to faceb

It doesn't seem like a real vulnerabilty to me - it is not remotely executable, it has to be run by a signed in user on the actual device. When you go to facebook.com, your device must surely decrypt the keychain to plaintext to prefill the password field so it can send your password to facebook.com - Thats how it works. So this seems like normal functionality to me, someone has just put it in a command line. Someone has just reverse engineered the keychain decrypt that happens all the time. Am I missing something?

aardshark 9y ago
Yes. When an app accesses the keychain a dialog box is presented to the user with "Allow", "Always Allow" and "Deny". If "Always Allow" is chosen, then the app will have permanent permission to access _only_ that particular password in the keychain. This vunerability appears to bypass that dialog entirely and dump the entire keychain in plaintext without requiring the users permisson.
thefreeman 9y ago
Yes, you are completely missing how the keychain works. When you go to facebook.com, safari requests access to the facebook.com password via the keychain api. At which point you are supposed to be prompted by the OS, and if you allow it, the keychain api returns the decrypted password only for facebook.com. The vulnerability being demonstrated is able to decrypt every password in your keychain, without prompting the user in any way.
- eugeniub 9y ago
  When I go to Facebook.com, my login credentials are instantly filled in by Safari. What prompt are you talking about?
  - jakobegger 9y ago
    You either gave Safari permission before, or Safari was the app that added the password to the keychain in the first place.
  - deleted 9y ago
    [deleted]
lloeki 9y ago
There is already a CLI tool, albeit secured by a GUI prompt asking for permission: $ security find-internet-password -s www.facebook.com -g This one seems to bypass asking for permission somehow.

aardshark 9y ago

Yes. When an app accesses the keychain a dialog box is presented to the user with "Allow", "Always Allow" and "Deny". If "Always Allow" is chosen, then the app will have permanent permission to access _only_ that particular password in the keychain. This vunerability appears to bypass that dialog entirely and dump the entire keychain in plaintext without requiring the users permisson.

thefreeman 9y ago

Yes, you are completely missing how the keychain works. When you go to facebook.com, safari requests access to the facebook.com password via the keychain api. At which point you are supposed to be prompted by the OS, and if you allow it, the keychain api returns the decrypted password only for facebook.com. The vulnerability being demonstrated is able to decrypt every password in your keychain, without prompting the user in any way.

eugeniub 9y ago
When I go to Facebook.com, my login credentials are instantly filled in by Safari. What prompt are you talking about?
- jakobegger 9y ago
  You either gave Safari permission before, or Safari was the app that added the password to the keychain in the first place.
- deleted 9y ago
  [deleted]

lloeki 9y ago

There is already a CLI tool, albeit secured by a GUI prompt asking for permission: $ security find-internet-password -s www.facebook.com -g This one seems to bypass asking for permission somehow.