Just as macOS High Sierra, security researcher Patrick Wardle tweeted a previously undisclosed (zero day) vulnerability in Keychain, Apple's secure credential repository. The vulnerability potentially affected a wide range of macOS versions. Apple has since mitigated the issue with a Supplemental Update, now available via the Mac App Store.
Wardle said he could put a malicious app on someone's Mac and then use that app to get around Keychain's security and pull out usernames and passwords programmatically.
That meant Wardle, or someone using the same exploit, would have to use a phishing attack or some form of social engineering to get the malicious app onto your Mac, then use that malicious app to go after your Keychain.
In the Supplemental Update, Apple offered the following mitigation:
A method existed for applications to bypass the keychain access prompt with a synthetic click. This was addressed by requiring the user password when prompting for keychain access.
The Keychain vulnerability, while bad and requiring this's fix, wasn't something macOS users needed panic about. At least not those used to following the same security best practices everyone in the industry has been talking about for years.
Namely, those that kept Apple's default Gatekeeper settings enabled and didn't download anything, or click on any links, they don't absolutely trust.
macOS is more open by design than iOS. Malicious apps have targeted trusted developers and even tried to get into the App Store through third-party code. They get found. They get fixed.
As the Mac's popularity continues to grow relative to the industry, it makes the economics of attacking Mac users more attractive to hackers.
Multi-layered defense-in-depth, from prevention to detection to removal, is the best way to keep ahead of new threats and handle newly discovered ones.
Firmware integrity protection, anti-malware, system integrity protection, Gatekeeper, and other services are how Apple is implementing defense-in-depth.
Since no code is perfect, exploits will keep coming up. So, what matters is how fast and well Apple — or any vendor — responds to exploits.
Download and install the Supplemental Update for macOS High Sierra as soon as possible and continue to keep informed and keep safe.
We may earn a commission for purchases using our links. Learn more.
Welcome to iPhone 13 Pro (maybe)
Apple is likely to announce a new round of iPhones later this year – will one look like this?
Stunning new 2021 iMac leak reveals new design in five colors
Jon Prosser at Front Page Tech has just revealed that Apple plans to unveil brand new iMacs with a total redesign and in five new colors.
Project Triangle Strategy offers small but unique takes on the RPG genre
Square Enix's latest strategy RPG project is coming to Nintendo Switch in 2022, but you don't have to wait that long to try it out. You can download the demo right now. Here's what we think of this new IP.
Webcam hacking is real, but you can protect yourself with a privacy cover
Worried people might be looking in through your webcam on your MacBook? No worries! Here are some great privacy covers that will protect your privacy.
