<story><title>New macOS malware steals info, including a user&apos;s entire Keychain database</title><url>https://www.malwarebytes.com/blog/news/2023/04/new-macos-malware-yoinks-a-trove-of-sensitive-information-including-a-users-entire-keychain-database</url></story><parent_chain><item><author>ghusto</author><text>&amp;gt; It lures users to download the software, run it, ignore the OS warning that the code isn’t signed, and then enter their password.&lt;p&gt;Warnings like this are useless when they bundle genuinely dodgy software along with software from legitimate companies I already trust and know. Those messages means nothing to me, and I ignore them, because they&amp;#x27;re warning me about something I already know &amp;quot;You&amp;#x27;re trying to run software you downloaded&amp;quot; — yeah, thanks.&lt;p&gt;&amp;gt; Make it impossible for user code to read the entire keychain&lt;p&gt;What I&amp;#x27;ve always found kind of bonkers, is that MacOS allows any command to read the entire contents of your keychain (yes, with all your passwords). No auth, no checks, just full access via the `security` command.&lt;p&gt;&amp;gt; Containerize macOS more, making it impossible for user programs to access files written by other programs, in the way things work on iOS?&lt;p&gt;Maybe? I don&amp;#x27;t know if that&amp;#x27;s the right direction (it definitely isn&amp;#x27;t for me, and I&amp;#x27;d jump ship), but perhaps that&amp;#x27;s the best thing for most people?</text></item><item><author>Someone</author><text>This malware gets onto systems 100% through social engineering. It lures users to download the software, run it, ignore the OS warning that the code isn’t signed, and then enter their password.&lt;p&gt;So, what should Apple do in response to such malware? Make it impossible for user code to read the entire keychain, even when running as admin? Containerize macOS more, making it impossible for user programs to access files written by other programs, in the way things work on iOS? Ignore it because, at some point, security becomes the user’s responsibility?&lt;p&gt;If tools like these get popular, I can see them getting blamed whatever they do or don’t do.</text></item></parent_chain><comment><author>codedokode</author><text>&amp;gt;  is that MacOS allows any command to read the entire contents of your keychain (yes, with all your passwords).&lt;p&gt;In Windows and Linux any application also can read any user&amp;#x27;s file. And in Chrome and Firefox, any extension can read browser history, capture key presses and so on. If you install Python packages, they can do anything to your computer, if you download a plugin for Gimp the same issue exists. On desktop security is broken since forever. OS developers (especially Linux developers) cannot innovate and use outdated security model from 80s where users are isolated from each other but today most computers have a single user and it makes little sense. Today you need to isolate program from a program, and prevent them from fingerprinting user&amp;#x27;s device (for example, in Linux any app can read MAC addresses, hardware serial numbers, list of nearby WiFi points and nobody cares about that).</text></comment>
<story><title>New macOS malware steals info, including a user&apos;s entire Keychain database</title><url>https://www.malwarebytes.com/blog/news/2023/04/new-macos-malware-yoinks-a-trove-of-sensitive-information-including-a-users-entire-keychain-database</url></story><parent_chain><item><author>ghusto</author><text>&amp;gt; It lures users to download the software, run it, ignore the OS warning that the code isn’t signed, and then enter their password.&lt;p&gt;Warnings like this are useless when they bundle genuinely dodgy software along with software from legitimate companies I already trust and know. Those messages means nothing to me, and I ignore them, because they&amp;#x27;re warning me about something I already know &amp;quot;You&amp;#x27;re trying to run software you downloaded&amp;quot; — yeah, thanks.&lt;p&gt;&amp;gt; Make it impossible for user code to read the entire keychain&lt;p&gt;What I&amp;#x27;ve always found kind of bonkers, is that MacOS allows any command to read the entire contents of your keychain (yes, with all your passwords). No auth, no checks, just full access via the `security` command.&lt;p&gt;&amp;gt; Containerize macOS more, making it impossible for user programs to access files written by other programs, in the way things work on iOS?&lt;p&gt;Maybe? I don&amp;#x27;t know if that&amp;#x27;s the right direction (it definitely isn&amp;#x27;t for me, and I&amp;#x27;d jump ship), but perhaps that&amp;#x27;s the best thing for most people?</text></item><item><author>Someone</author><text>This malware gets onto systems 100% through social engineering. It lures users to download the software, run it, ignore the OS warning that the code isn’t signed, and then enter their password.&lt;p&gt;So, what should Apple do in response to such malware? Make it impossible for user code to read the entire keychain, even when running as admin? Containerize macOS more, making it impossible for user programs to access files written by other programs, in the way things work on iOS? Ignore it because, at some point, security becomes the user’s responsibility?&lt;p&gt;If tools like these get popular, I can see them getting blamed whatever they do or don’t do.</text></item></parent_chain><comment><author>js2</author><text>&amp;gt; MacOS allows any command to read the entire contents of your keychain (yes, with all your passwords). No auth, no checks, just full access via the `security` command.&lt;p&gt;No, that&amp;#x27;s not true. macOS has multiple keychain APIs with different capabilities.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;developer.apple.com&amp;#x2F;documentation&amp;#x2F;technotes&amp;#x2F;tn3137-on-mac-keychains&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;developer.apple.com&amp;#x2F;documentation&amp;#x2F;technotes&amp;#x2F;tn3137-o...&lt;/a&gt;&lt;p&gt;Items within the traditional keychain can have ACLs applied to them. When you run `security dump -d`, it will only be able to dump items from a traditional keychain that are either set to allow access to all apps, or that have an ACL that grants access to `security`. Very few items should be set to &amp;quot;Allow All&amp;quot;. In my login keychain, almost none are.&lt;p&gt;For all other items you will get a security prompt with &amp;quot;Always Allow&amp;quot;, &amp;quot;Allow&amp;quot;, and &amp;quot;Deny&amp;quot; which requires you to enter your password. You can also set items to require confirmation but not require the keychain&amp;#x27;s password.&lt;p&gt;If you add `security` to an item&amp;#x27;s ACL--say because you need access to that item from a script--then any app can of course access that item by calling `security`. My advice would be not to add `security` to any item&amp;#x27;s ACL.&lt;p&gt;AFAIK, `security` has no access to the iCloud Keychain where Safari stores its passwords. If you don&amp;#x27;t have iCloud Keychain enabled, I believe Safari stores its passwords in a traditional file-based keychain but those items should have ACLs on them.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;support.apple.com&amp;#x2F;guide&amp;#x2F;security&amp;#x2F;keychain-data-protection-secb0694df1a&amp;#x2F;web&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;support.apple.com&amp;#x2F;guide&amp;#x2F;security&amp;#x2F;keychain-data-prote...&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;support.apple.com&amp;#x2F;guide&amp;#x2F;security&amp;#x2F;icloud-keychain-security-overview-sec1c89c6f3b&amp;#x2F;web&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;support.apple.com&amp;#x2F;guide&amp;#x2F;security&amp;#x2F;icloud-keychain-sec...&lt;/a&gt;</text></comment>