News for hackers. Stuff that matters.

A comment on New macOS malware steals info, including a user's entire Keychain database. Parent comment

Re:New macOS malware steals info, including a user's entire ... by ghusto on Sunday April 16, 2023 @03:38AM (#35588050)
> Items within the traditional keychain can have ACLs applied to them. When you run `security dump -d`, it will only be able to dump items from a traditional keychain

Could it be that the Terminal has full access then? I've never been asked for a password, or had a restriction of any kind put on me, when using the `security` command. Those prompts you speak of are for the "Keychain Access" GUI, no?

[ Parent | on HN ]
Re:New macOS malware steals info, including a user's entire ... by js2 on Sunday April 16, 2023 @10:53AM (#35590513)
Access is gated upon `/usr/bin/security`, not the Terminal app.

The security prompt to "Allow All", "Allow", or "Deny" when a process tries to access a keychain item's value is a GUI window, but it's not part of any app.

[ Parent | on HN ]