« PayPal: Avoid Safari | Main | Are Comcast Flacks Scouring the Valley for Fresh Advocates? »
February 28, 2008
"Coldboot" Team Member Discovers OS X Password Vulnerability
"The vulnerability arises out of a programming error that stores the account password in the computer's memory long after it's needed, meaning it can be retrieved and used to log into the computer and impersonate the user.
"'This is a real problem and it needs to be fixed,' said Jacob Appelbaum, a San Francisco-area programmer who discovered the vulnerability and reported it to Apple. He said he disagreed with the company's response: 'They won't put it in the latest security update or release a security update just for this issue.'
...
"Unlike the security concerns reported last week, this vulnerability is specific to OS X. It's also more sweeping because it offers--at least in OS X's default configuration--full access to passwords stored in the Keychain, which can include passwords to wireless networks, Web sites, accounts accessed via SSH, network-mounted volumes, and so on."
The whole article's worth reading: The team demonstrates lots of ways for the attack to work.
(Link), via BoingBoing
Posted by mhall at 7:16 PM | Add Comment
Leave a comment