News, info, and opinion by Mac users, for Mac users.

April 27, 2007

security

MacLockPick cracks your files like eggs

Posted Apr. 27, ’07, 9:48 AM PT by Dan Moren
Category | Security

MacLockPickEver since I was a young tot, I’ve been fascinated with the ins-and-outs of espionage. Later in life, this merged with my interest in technology, enough so that I learned a few simple tricks that could be used to prank friends (spoofing email from our college registrar’s office, for example; or cracking a login password), but I’m a far way from a l33t über hacker.

And while there’s virtually no way I’ll ever get my hands on SubRosaSoft’s new MacLockPick device, it doesn’t mean that I don’t crave a hands-on with the little feller like a junky jonesing for his next hit. This $499 flash drive (discounts are available for bulk purchases and police) is available only to law enforcement personnel and licensed investigators (proof of which is required to buy it—I’m guessing that plastic badge I have won’t cut it). But just pop it into a running or sleeping computer’s USB port and it’ll retrieve oodles of information about your perp. Frankly, the list of stuff it can pick up is terrifying—it’ll make you glad this sucker isn’t available to every Tom, Dan, and Harry who should happen by:

System - The user password of the logged in user. Often this is shared for root access and FileVault encryption.
General - Includes (but is not limited to) passwords for encrypted disk images, wifi base stations, iTunes music store, iChat login, Apple Remote Desktop.
Internet - Includes (but is not limited to) login and password details for web sites, email accounts, some peer to peer networks, online services and stores, auction sites, and .mac accounts.
AppleShare - A list of login and password details for appleshare servers this mac has connected to.
And that’s just what it pulls from the keychain. How does it work? According to the product page:
MacLockPick takes advantage of the fact that the default state of the Apple Keychain is open, even if the system has been put to sleep.It also makes use of the openly readable settings files used to keep track of your suspect’s contacts, activities and history. These data sources even include items that your suspect may have previously deleted or has migrated from previous Mac OS X computers.
Sounds as though it’s time for a little primer on keeping your keychain secure. Here’s hoping that I never end up on the wrong side of the MacLockPick—not that I have anything to hide. Heh heh. Er, I have to go now.

[via Macworld]

Update: Clarified pricing.


6 Comments

Rob said:

Now THIS is the kind of security exploit that's a lot more worrisome than the browser-QuickTime-Java one that's been garnering all the recent and unwarranted attention.
If a developer can create a law-enforcement product that can do this, I'm sure the talented hacker community can come up with the same abilities for their own nefarious ends.
Apple, please add this open keychain access to your patch list.

April 27, 2007 10:17 AM
john said:

If the keychain is locked with an admin password of the user, how does this thumbdrive get access to the keychain info? I would be very curious to know how?

April 27, 2007 11:22 AM
Tim Author Profile Page said:

It's $499 not $399

April 27, 2007 12:09 PM
Mike said:

There's nothing to patch in Keychain Access. The article plainly stated that MacLockPick takes advantage of the DEFAULT (emphasis mine) state of the keychain. To change the default behavior, open Keychain Access, select the keychain login in the upper left pane, in the Edit menu select Change Settings for Keychain "login"..., and in the popup window you can check Lock when sleeping and/or Lock after N minutes of inactivity. This will result in different behavior when waking from sleep, like if you connect to a wireless network that uses encryption you will have to enter your keychain password to reconnect to the network, or if you are on a wired network, the next time you check email you will have to enter your keychain password. Security and convenience are usually trade-offs, and Apple has given you the flexibility to choose which is more important to you.

April 27, 2007 3:45 PM
Michael Long said:

Agreed. Apple needs to close this door. Fast.

April 27, 2007 5:37 PM
Thomas GvL Author Profile Page said:

Scary...

April 27, 2007 5:48 PM

Leave a comment

 



Visit other IDG sites: