macOS Keychain vulnerability — what you need to know!

Just as macOS High Sierra, security researcher Patrick Wardle tweeted a previously undisclosed (zero day) vulnerability in Keychain, Apple's secure credential repository. The vulnerability potentially affected a wide range of macOS versions. Apple has since mitigated the issue with a Supplemental Update, now available via the Mac App Store.

Wardle said he could put a malicious app on someone's Mac and then use that app to get around Keychain's security and pull out usernames and passwords programmatically.

That meant Wardle, or someone using the same exploit, would have to use a phishing attack or some form of social engineering to get the malicious app onto your Mac, then use that malicious app to go after your Keychain.

In the Supplemental Update, Apple offered the following mitigation:

A method existed for applications to bypass the keychain access prompt with a synthetic click. This was addressed by requiring the user password when prompting for keychain access.

The Keychain vulnerability, while bad and requiring this's fix, wasn't something macOS users needed panic about. At least not those used to following the same security best practices everyone in the industry has been talking about for years.

Namely, those that kept Apple's default Gatekeeper settings enabled and didn't download anything, or click on any links, they don't absolutely trust.

macOS is more open by design than iOS. Malicious apps have targeted trusted developers and even tried to get into the App Store through third-party code. They get found. They get fixed.

As the Mac's popularity continues to grow relative to the industry, it makes the economics of attacking Mac users more attractive to hackers.

Multi-layered defense-in-depth, from prevention to detection to removal, is the best way to keep ahead of new threats and handle newly discovered ones.

Firmware integrity protection, anti-malware, system integrity protection, Gatekeeper, and other services are how Apple is implementing defense-in-depth.

Since no code is perfect, exploits will keep coming up. So, what matters is how fast and well Apple — or any vendor — responds to exploits.

Download and install the Supplemental Update for macOS High Sierra as soon as possible and continue to keep informed and keep safe.



This post may contain affiliate links. See our disclosure policy for more details.

Latest And Best Prime Day Deals

Amazon's Fire TV Cube is down to just $70 thanks to this Prime Day deal
Amazon Fire TV Cube
$69.99 $119.99 Save $50

Save $80 on the Neato D4 robot vacuum during this Prime Day Lightning deal
Neato Robotics D4 Alexa-enabled laser-guided robot vacuum cleaner
$319.99 $400.00 Save $80

Time is running out. And so is the supply. Grab it while you can.

Grab TCL's 32-inch 720p Roku TV for less than $100 in this Prime Day Lightning deal
TCL 32S325 32-inch 720p Roku TV
$99.99 $130.00 Save $30

Act fast while you can. These Lightning deals tend to sell out quick.

The Ring Alarm security system is reaching new low prices for Prime Day
Ring Alarm home security systems

Various configurations of the Ring Alarm are discounted to their best prices yet exclusively for Prime members at Amazon through Tuesday night to help keep your home secure.

The Sonos Beam Prime Day deal includes a $40 discount and 2 $50 Amazon gift cards
The Sonos Beam Prime Day deal includes a $40 discount and $100 in Amazon gift cards
$359.00 $499.00 Save $140

That's just so much savings in one deal. You'll have to wait for the physical gift cards, but that's basically $100 to spend however you want.

Prime Day dropped this PlayStation 4 console bundle to just $250
PlayStation 4 Slim 1TB console with Marvel's Spider-Man and Horizon Zero Dawn
$249.99 $359.98 Save $110

This deal on the PlayStation 4 Slim console saves you $50 off its regular price while also including Marvel's Spider-Man and Horizon Zero Dawn Complete Edition for free. You'll just need an Amazon Prime membership to snag it.

The newest device in the Echo family, the Show 5, is now down to just $50
Echo Show 5
$49.99 $89.99 Save $40

It's only been on the market since May, but it hasn't escaped the Prime Day price cuts.

Amp up your home security with these huge Prime Day discount on nearly all Ring products
Save on Ring products today only

Whether you need a video doorbell, whole home alarm system, or some lights to brighten a dark area, Amazon has it all marked down today!

More Prime Day Deals