3 ms·

> Malware could steal passwords, encrypted messages and contacts Does this include 1password passwords? As far as I understand 1password encrypts the passwords

> Malware could steal passwords, encrypted messages and contacts Does this include 1password passwords? As far as I understand 1password encrypts the passwords and they can only be accessed either by supplying the master password or the fingerprint.

Mathnerd314 7y ago
The exploit gets full root and full access to the keychain store. And apparently the 1password master password is stored in the keychain when sync is enabled (https://discussions.agilebits.com/discussion/10412/storage-of-master-password-on-ios-devices https://discussions.agilebits.com/discussion/10412/storage-o...). So they had the technical ability to steal at least a few 1password passwords. But 1password is not in the default list of apps to steal (https://googleprojectzero.blogspot.com/2019/08/implant-teardown.html https://googleprojectzero.blogspot.com/2019/08/implant-teard...), so you'd have to know what commands their server sent to get a definitive answer. Most likely they didn't bother, as it seems more like a surveillance / monitoring operation than for financial gain, but then again attackers are getting more sophisticated all the time.
- tucif 7y ago
  What kind of sync is that? Only if you manage your vaults externally (e.g. Dropbox)?
  - Mathnerd314 7y ago
    I was thinking about the sync you get with a premium membership (https://support.1password.com/sync-options/ https://support.1password.com/sync-options/), but I guess the thread is about syncing with Dropbox. It's quite an old thread, this paper suggests they use the "secure remote password" protocol for memberships, so perhaps the master key isn't stored for that: https://1password.com/files/1Password%20for%20Teams%20White%20Paper.pdf https://1password.com/files/1Password%20for%20Teams%20White%... It's definitely stored for Touch ID/fingerprint 1password access though (https://support.1password.com/touch-id-security-ios/ https://support.1password.com/touch-id-security-ios/). One of their employees wrote about it here: https://discussions.agilebits.com/discussion/106629/ios-security-breach https://discussions.agilebits.com/discussion/106629/ios-secu.... His response is basically that OS-level 0days aren't in their threat model, so they're continuing their usual bug-fixing routine. And it's true, nothing can really stop a rootkit from sniffing passwords as they're being used, besides winning the anti-rootkit race. Perhaps 1password could have a little more explanation of the insecurity of using Touch ID / Face ID though rather than simply saying it's as secure as possible.
- abc_lisper 7y ago
  But keychain itself is encrypted . I thought it was stored in secure vault too. Anyways, how does finding a kernel issue, let them subvert a hardware based decryption mechanism, like face-id or thumbprint

Mathnerd314 7y ago

The exploit gets full root and full access to the keychain store. And apparently the 1password master password is stored in the keychain when sync is enabled (https://discussions.agilebits.com/discussion/10412/storage-of-master-password-on-ios-devices https://discussions.agilebits.com/discussion/10412/storage-o...). So they had the technical ability to steal at least a few 1password passwords. But 1password is not in the default list of apps to steal (https://googleprojectzero.blogspot.com/2019/08/implant-teardown.html https://googleprojectzero.blogspot.com/2019/08/implant-teard...), so you'd have to know what commands their server sent to get a definitive answer. Most likely they didn't bother, as it seems more like a surveillance / monitoring operation than for financial gain, but then again attackers are getting more sophisticated all the time.

tucif 7y ago
What kind of sync is that? Only if you manage your vaults externally (e.g. Dropbox)?
- Mathnerd314 7y ago
  I was thinking about the sync you get with a premium membership (https://support.1password.com/sync-options/ https://support.1password.com/sync-options/), but I guess the thread is about syncing with Dropbox. It's quite an old thread, this paper suggests they use the "secure remote password" protocol for memberships, so perhaps the master key isn't stored for that: https://1password.com/files/1Password%20for%20Teams%20White%20Paper.pdf https://1password.com/files/1Password%20for%20Teams%20White%... It's definitely stored for Touch ID/fingerprint 1password access though (https://support.1password.com/touch-id-security-ios/ https://support.1password.com/touch-id-security-ios/). One of their employees wrote about it here: https://discussions.agilebits.com/discussion/106629/ios-security-breach https://discussions.agilebits.com/discussion/106629/ios-secu.... His response is basically that OS-level 0days aren't in their threat model, so they're continuing their usual bug-fixing routine. And it's true, nothing can really stop a rootkit from sniffing passwords as they're being used, besides winning the anti-rootkit race. Perhaps 1password could have a little more explanation of the insecurity of using Touch ID / Face ID though rather than simply saying it's as secure as possible.
abc_lisper 7y ago
But keychain itself is encrypted . I thought it was stored in secure vault too. Anyways, how does finding a kernel issue, let them subvert a hardware based decryption mechanism, like face-id or thumbprint