Here\u2019s an interesting exploit from the land of Apple. A new zero-day, demonstrated in a YouTube video by security researcher Linus Henze, makes it possible for an attacker without administrative privileges or root access to steal all the passwords and encryption keys<\/a> saved in a Mac\u2019s keychain.<\/p>\n\n\n\n And here\u2019s where it gets interesting. In protest of Apple\u2019s\nlack of a bug bounty program, the researcher who discovered the exploit isn\u2019t\nsharing the details. <\/p>\n\n\n\n So, let\u2019s spend a few minutes talking about the KeySteal exploit,\nbug bounty programs and whether it\u2019s fair to extort a company with something\nlike this.<\/p>\n\n\n\n Let\u2019s hash it out.<\/span><\/p>\n\n\n\n Keychain is Apple\u2019s built-in key and password manager. It\u2019s\na critical component of macOS, storing all of the system\u2019s passwords,\nencryption keys and digital certificates. Obviously, as we cover all the time,\ncertificate management and key security are of the utmost importance considering\nall the can go wrong when a compromise occurs.<\/p>\n\n\n<\/span><\/span>\n\n\n In 2017, a researcher named Patrick Wardle discovered an\nexploit that he named KeychainStealer, which Apple promptly patched. Henze\u2019s\nexploit, KeySteal, is like the spiritual successor to KeychainStealer, and it\nis still wide open. <\/p>\n\n\n\n In the video below, posted to YouTube, Henze demonstrates\nthe exploit on a 2014 MacBook Pro. <\/p>\n\n\n\nKeySteal and Keychain<\/h2>\n\n\n\n