Researchers at Indiana University, Peking University, the Georgia Institute of Technology, and Tsinghua University have published a paper detailing a new category of security weaknesses in Apple\u2019s operating system software.<\/p>\n
They call this category XARA, short for cross-app resource access, and explained that the keychain and WebSocket on OS X, and URL Scheme on iOS could be exploited to gain access to private data.<\/p>\n
According to the researchers, they notified Apple about the vulnerability on 15 October 2014, and were informed that the company needed 6 months to fix the issue.<\/p>\n
\u201cWe checked the most recent OS X 10.10.3 and beta version 10.10.4 and found that they attempted to address the iCloud issue using a 9-digit random number as accountName,\u201d the researchers said.<\/p>\n
However, the account name attribute for other services remains unobfuscated. Gmail, for example, still uses your email address as the username.<\/p>\n
\u201cMost importantly, such protection, based upon a secret attribute name, does not work when the attacker reads the attribute names of an existing item and then deletes it to create a clone under its control.”<\/p>\n
They noted that this is a new problem they discovered after the first keychain vulnerability report, and are helping Apple to fix it.<\/p>\n
In a blog post<\/a><\/strong> about the vulnerability, security firm Sophos explained that the researchers essentially exploited what is known as a race condition in Keychain on OS X.<\/p>\n Normally when you choose to store your username and password for an application, website, or Wi-Fi hotspot, a login cookie is created in Keychain which only that application or service would have access to.<\/p>\n A race condition is created if a malicious app creates a login cookie and grants another application permission to access that Keychain item.<\/p>\n However, there is one trick: the application being subverted must not have created its own Keychain item yet.<\/p>\n Unfortunately there is a workaround to this, Sophos reported, as it may be possible for the malicious app to delete the login cookie of other applications – allowing it to trigger the race condition.<\/p>\n Stealing credentials from Keychain is only one possible application of XARA attacks, the researchers wrote.<\/p>\n Not only were they able to get a user\u2019s login for iCloud, e-mail, and bank accounts, they also successfully demonstrated breaking Apple\u2019s App sandbox.<\/p>\n They said that they wrote a proof of concept application that does this, and managed to get it through Apple\u2019s checks and published on the App Store.<\/p>\n These exploits were demonstrated in a series of videos which were published in an article on The Register<\/a><\/strong>, and are embedded below.<\/p>\nDire consequences<\/h3>\n