Thursday, June 18, 2015

Serious OS X and iOS flaws let hackers steal keychain, 1Password contents

I only saw a couple of articles on this and I waited until Ars wrote their typically comprehensive piece, Serious OS X and iOS flaws let hackers steal keychain, 1Password contents.

"Researchers have uncovered huge holes in the application sandboxes protecting Apple's OS X and iOS operating systems, a discovery that allows them to create apps that pilfer iCloud, Gmail, and banking passwords and can also siphon data from 1Password, Evernote, and other apps.

The malicious proof-of-concept apps were approved by the Apple Store, which requires all qualifying submissions to treat every other app as untrusted. Despite the supposed vetting by Apple engineers, the researchers' apps were able to bypass sandboxing protections that are supposed to prevent one app from accessing the credentials, contacts, and other resources belonging to another app. Like Linux, Android, Windows, and most other mainstream OSes, OS X and iOS strictly limit app access for the purpose of protecting them against malware. The success of the researchers' cross-app resource access—or XARA—attacks, raises troubling doubts about those assurances on the widely used Apple platforms."

1 comment:

Megan O'Brien said...

Hi, I'm Megan and I work for AgileBits, the makers of 1Password.

I just wanted to clarify here that the attack described in this research is not directed at the encrypted 1Password database. For our security expert's thoughts on this article, please see our blog: https://blog.agilebits.com/2015/06/17/1password-inter-process-communication-discussion/. If you have further questions, we'd love to hear your thoughts in our discussion forums: https://discussions.agilebits.com.