Identity & Access

macOS Mojave Zero-Day Allows Theft of Keychain Passwords

A researcher has disclosed the existence of a zero-day vulnerability in macOS Mojave that can be exploited by malware to steal plaintext passwords from the operating system’s Keychain. The flaw has not been reported to Apple, but its details have not been made public.

Eduard Kovacs

February 6, 2019

Germany-based Linus Henze has published a video showing how a malicious application installed on a system running the latest release of Apple’s macOS Mojave operating system (10.14.3) can extract passwords from the local Keychain password management system.

According to Henze, the malicious app and the user account on which it is running don’t require admin privileges for the attack to work. However, passwords can only be obtained from that user’s Keychain – other Keychains are likely inaccessible due to the fact that they are typically locked and the attack only works against unlocked Keychains.

The researcher says he has not reported his findings to Apple due to the lack of a bug bounty program for macOS. Apple does have a bug bounty program, with rewards of up to $200,000, but it only covers hardware, iCloud and iOS hacks.

Henze says he has been contacted by Apple’s product security team after publishing the video, but he claims he will not share full details of the attack with the tech giant without a bounty.

While the details of the vulnerability have not been made public to prevent abuse, researcher Patrick Wardle, who in 2017 discovered a similar vulnerability in macOS High Sierra, has confirmed for Forbes that the vulnerability found by Henze exists and the exploit works.

Henze claims the vulnerability impacts macOS Mojave and earlier versions. A video published by the researcher shows his proof-of-concept (PoC) tool in action:

Written By Eduard Kovacs

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Latest News

Click to comment

Webinar: How to Build Resilience Against Emerging Cyber Threats

Thursday, March 16, 2023

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.

Webinar: Understanding Hidden Third-Party Identity Access Risks

Tuesday, March 28, 2023

Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.

Why Endpoint Resilience Matters

When establishing visibility and security controls across endpoints, security professionals need to understand that each endpoint bears some or all responsibility for its own security. (Torsten George)

What Makes an Effective Anti-Bot Solution?

While there are likely many different approaches, here are a few points that are important for enterprises to consider when evaluating bot solutions. (Joshua Goldfarb)

Tackling the Challenge of Actionable Intelligence Through Context

Making threat intelligence actionable requires more than automation; it also requires contextualization and prioritization. (Marc Solomon)

Malware Trends: What’s Old Is Still New

Many of the most successful cybercriminals are shrewd; they want good ROI, but they don’t want to have to reinvent the wheel to get it. (Derek Manky)

Are Encryption and Zero Trust Breaking Key Protections?

Compliance and ZTNA are driving encryption into every aspect of an organization’s network and enterprise and, in turn, forcing us to change how we think about protecting our environments. (Matt Wilson)