Every System is Vulnerable
How many Mac owners do you know that have bothered to install an antivirus software on their machine? Probably very few, and that's because over the years Apple has created a reputation for delivering the most secure computing platform in the industry. There's a common belief that a Mac is "unhackable" or that there are no successful viruses for Mac. Apple devices are widely considered impenetrable and secure compared to classic Windows computers and phones. And thus millions of Mac owners deem themselves safe without every running security scans on the programs they install, believing themselves to be completely safe.
Keychain Vulnerability
Unfortunately, that bubble of safety isn't realistic, as became painfully obvious upon the release of the new High Sierra OS. For all of its upgrades and new features, there's was a critical error hiding just behind the scenes- a new exploit found in and run on the latest High Sierra operating system. Thankfully this was discovered by Patrick Wardle, an ex-employee of the NSA and white-hat hacker. The exploit allowed passwords to be stolen in plain text extremely easily, bypassing encryption and the usual master password and root access needed for such a feat. Wardle created a video of himself utilizing the exploit in action but has retained key parts so that it will hopefully not be replicated by those with darker intentions. The vulnerability is no joking manner, exposing Macs on the new operating system to the less savory people on the internet.
If you've ever asked Safari to save a password so you don't have to remember it, then you've made use of Apple's Keychain feature. Now, anything that has been saved to Keychain is vulnerable to the exploit. Passwords can be stolen from Keychain in their unencrypted form by a vulnerability that any third-party program can access. Any program that doesn't come from a trusted source like the Mac App Store can use this vulnerability to steal passwords, putting everything from bank credentials to your Facebook account in jeopardy. Whether that program comes in the form of a malicious email or seemingly harmless download is irrelevant. Within little time, a hacker will be able to see the content of every username and password you have saved with Keychain.
Protect Your Macs With Addigy
Apple has been alerted about the bug and have since patched it.
You can do a few things on your own to help prevent any future exploits. First, only install apps from the Mac App Store or credible vendors that you trust. Second, disable third-party app installation from Settings so that you can't accidentally allow a malicious program to your computer. And third, avoid visiting sites with a heavy use of pop-up ads and clickbait, which often contain links to viruses and spam that will increase your risk of exploitation.
However, not everything can be done on an individual basis, and a single person can leave the whole team vulnerable if they mismanage their computer. That's where Addigy comes in. It will allow you to block users from installing the High Sierra update, significantly reducing chances of something breaking unexpectedly. Addigy can also assist you in making your machines as secure as possible even if you're using newer Macs that have arrived with High Sierra preinstalled through the use of our custom profiles and policies which will remain persistent throughout your environment, preventing users from engaging in actions that put their machines at risk.
Existing Addigy partners can being patching each machine immediately:
Through the power of Addigy, you can make sure that no one takes advantage of your machines with our cloud platform for IT administrators. To start securing your Macs today, get in touch with us and find out more about our management solution.
Keep I.T. Real,
The Addigy Team.
