keychainStealer may be bad, but it isn’t any reason to skip macOS High Sierra If your Keychain password is different from your Mac login password, the hack doesn’t work.

We encourage users to download software only from trusted sources like the Mac App Store, and to pay careful attention to security dialogs that macOS presents.įinally, keychainStealer assumes the user is logged into their Mac and are using the same password for their user account and Keychain database. MacOS is designed to be secure by default, and Gatekeeper warns users against installing unsigned apps, like the one shown in this proof of concept, and prevents them from launching the app without explicit approval. Second, it requires users to install an app that should trigger a GateKeeper alert because it isn’t signed with a valid developer certificate.Īpple addressed that in a statement to Macworld saying, First, it isn’t a threat that’s in the wild-at least not yet. While the threat is real, it isn’t one most Mac users are likely to encounter.

Gizmodo reports Wardle alerted Apple to the threat on September 7th, and a patch is likely already in the works. Normally you are not supposed to be able do that programmatically. Without root priveleges, if the user is logged in, I can dump and exfiltrate the keychain, including plaintext passwords. On High Sierra (unsigned) apps can programmatically dump & exfil keychain (w/ your plaintext passwords)🍎🙈😭 vid: #smh /pqtpjZsSnq

Mac os high sierra review gizmodod