4 ms·

From the paper: > Since the issues may not be easily fixed, we built a simple program that detects exploit attempts on OS~X, helping protect vulnerable apps be

by drtse4 11y ago

From the paper: > Since the issues may not be easily fixed, we built a simple program that detects exploit attempts on OS~X, helping protect vulnerable apps before the problems can be fully addressed. I'm wondering if the tool is publicly accessible, couldn't find any reference to it.

jdc0589 11y ago
was wondering the same thing... finding items with more than 1 application is the important part. so this is a start: security dump-keychain -a > keychain.txt && egrep -n "applications \(([2-9])\)" keychain.txt Then just look at the item that contains those line numbers and see whats up. You will have some show up on an unaffected system. This is what my output looks like: http://puu.sh/ishaP/675695b11e.png http://puu.sh/ishaP/675695b11e.png * disclaimer, that egrep regex is shit.
- c0wb0yc0d3r 11y ago
  Can you skip the whole writing to file bit, and pipe straight to egrep?
  - jdc0589 11y ago
    sure. but then you wouldn't have a file to go investigate the matched line numbers in.
    - lindig 11y ago
      security dump-keychain -a | egrep -A 9 -n "applications \(([2-9])\)" This gives you the relevant lines right away: 9 lines following the match (you might want to use fewer).