5 ms·

If this is how it works, you can check it on OS X by clicking each item in Keychain Access and looking at the Access Control tab or you can run `security dump-k

If this is how it works, you can check it on OS X by clicking each item in Keychain Access and looking at the Access Control tab or you can run `security dump-keychain -a` in terminal - it lists all keychain items and their access control lists. It's still a big and unwieldy list but not as bad as clicking each keychain item. Someone better at this stuff could probably think of a way to make it easier. (This would only show if you've been exploited already, not that some app is capable of doing it.)

obituary_latte 11y ago
>This would only show if you've been exploited already What would indicate a compromise?
- alimbada 11y ago
  If the ACL of a keychain item contains an app that isn't supposed to have access to that keychain item then that would indicate a compromise.
  - obituary_latte 11y ago
    Ah ok that makes sense. Thanks very much.
MaysonL 11y ago
I'm curious: do you have any idea why after running this command would security start asking for password for various keychains?
- pilsetnieks 11y ago
  It goes over all keychains so I'm assuming (at least it was so for me) that it asked for password for locked keychains. `security` is a built-in system utility, basically Keychain Access for terminal, the same way that `diskutil` is Disk Utility but in the terminal.
bshep 11y ago
The results are pretty unwieldly if you have a lot of passwords so I used the following snippet to sift through the crud cat results.txt | grep -A 20 'applications' |grep \[0-9\]: | grep -v entry | grep -v description | cut -d\ -f14- | sort | uniq I made a couple of assumptions so YMMV: - up to 10 apps in the ACL ( the max I saw in mine was 7 ) - the word 'entry' or 'decription' was no present in the app name
peterhil 11y ago
Here is a more comprehensive one-liner to see all items with more than 1 applications on a ACL list: security dump-keychain -a > keychain-results.txt grep -P '(^(class|keychain):|\s+("(svce|acct)"|0x0000000(1|7)) <blob>="[^"]*"|^\s+applications \(([2-9]|[0-9]{2,})\):|^\s+[0-9]+:)' keychain-results.txt | \ perl -pe 's/\n/\0/g' | perl -pe 's/\0keychain:/\nkeychain:/g' | \ grep -aP 'applications \(([2-9]|[0-9]{2,})\):' | \ sort -u | perl -pe 's/\0/\n/g'

obituary_latte 11y ago

>This would only show if you've been exploited already What would indicate a compromise?

alimbada 11y ago
If the ACL of a keychain item contains an app that isn't supposed to have access to that keychain item then that would indicate a compromise.
- obituary_latte 11y ago
  Ah ok that makes sense. Thanks very much.

MaysonL 11y ago

I'm curious: do you have any idea why after running this command would security start asking for password for various keychains?

pilsetnieks 11y ago
It goes over all keychains so I'm assuming (at least it was so for me) that it asked for password for locked keychains. `security` is a built-in system utility, basically Keychain Access for terminal, the same way that `diskutil` is Disk Utility but in the terminal.

bshep 11y ago

The results are pretty unwieldly if you have a lot of passwords so I used the following snippet to sift through the crud cat results.txt | grep -A 20 'applications' |grep \[0-9\]: | grep -v entry | grep -v description | cut -d\ -f14- | sort | uniq I made a couple of assumptions so YMMV: - up to 10 apps in the ACL ( the max I saw in mine was 7 ) - the word 'entry' or 'decription' was no present in the app name

peterhil 11y ago

Here is a more comprehensive one-liner to see all items with more than 1 applications on a ACL list: security dump-keychain -a > keychain-results.txt grep -P '(^(class|keychain):|\s+("(svce|acct)"|0x0000000(1|7)) <blob>="[^"]*"|^\s+applications \(([2-9]|[0-9]{2,})\):|^\s+[0-9]+:)' keychain-results.txt | \ perl -pe 's/\n/\0/g' | perl -pe 's/\0keychain:/\nkeychain:/g' | \ grep -aP 'applications \(([2-9]|[0-9]{2,})\):' | \ sort -u | perl -pe 's/\0/\n/g'