Blog Elements

Half Sized Blog Element (Single Author Style)

Half Sized Blog Element (Multi Author Style)

Mac OS X Security Keychain

2018-11-07/0 Comments/in Mac OS X/by Kellep Charles

The keychain is a secure database store for passwords and certificates and is created for each user account on Mac OS X. The system software itself uses keychains for secure storage.

SSD Encryption from Crucial and Samsung is not secure Exposes Data

2018-11-06/0 Comments/in Vulnerability/by Kellep Charles

The researchers examined multiple SSDs, including Crucial and Samsung, some of which they found could be unlocked with any password if the password validation routine in RAM was modified through a standard JTAG debugging interface.

Mac OS X Security Keychain

2018-11-07/0 Comments/in Mac OS X/by Kellep Charles

The keychain is a secure database store for passwords and certificates and is created for each user account on Mac OS X. The system software itself uses keychains for secure storage.

SSD Encryption from Crucial and Samsung is not secure Exposes Data

2018-11-06/0 Comments/in Vulnerability/by Kellep Charles

Full Sized Blog Element (Big Preview Pic)

Mac OS X Security Keychain

2018-11-07/0 Comments/in Mac OS X/by Kellep Charles

The keychain is a secure database store for passwords and certificates and is created for each user account on Mac OS X. The system software itself uses keychains for secure storage. The “login” keychain is the default location for user credentials and should be protected, while the keychain is unlocked all passwords in the keychain can be exported. The login keychain should be locked when the system sleeps or after long periods of inactivity.

Changing your keychain password

When a keychain mismatch occurs, the user must change their keychain password to match the password used to log on to the machine. To correctly change your keychain password, the user will use the application Keychain Access. Keychain Access is located in Applications\Utilities.

Change your keychain password:

Select “login” under the list of keychains.
From the menu at the top of the screen, click Edit.
Select Change Password for Keychain “login”…
Enter the current keychain password. Remember that the “current” keychain password is the password previously used to log into the machine, before your most recent password change.
Enter your new password and verify. The new password you enter should match the password you used to log into the machine.

SSD Encryption from Crucial and Samsung is not secure Exposes Data

2018-11-06/0 Comments/in Vulnerability/by Kellep Charles

Carlo Meijer and Bernard van Gastel, two researchers at Radboud University in the Netherlands issued a warning that hardware encryption in various models of Solid State Drives (SSDs) are not secure. The vulnerabilities only affected “ATA security” and “TCG Opal hardware-based encryption on SEDs. Furthermore, it affected the hardware-based encrypted SSD models with a local built-in chip, separate from the main CPU.

The two stated that the SEDs they’ve analyzed, allowed users to set a password that decrypted their data, but also came with support for a so-called “master password” that was set by the SED vendor.

They stated,

“Any attacker who read an SED’s manual can use this master password to gain access to the user’s encrypted password, effectively bypassing the user’s custom password”.

Other issues are detailed in the researchers’ paper, titled “Self-encrypting deception: weaknesses in the encryption of solid state drives (SSDs),” which can be downloaded in PDF format from here.

Due to limited access to SSDs, Meijer and van Gastel said they’ve only tested their findings on a small number of devices, listed in the table below, but found that all were vulnerable.