'Apple marketing has done a great job convincing people that macOS is secure, and I think that this is rather irresponsible and leads to issues where Mac users are overconfident and thus more vulnerable,' he added. I felt that users should be aware of the risks that are out there I'm sure sophisticated attackers have similar capabilities.'
'I don't mean that to be taken personally by anybody at Apple - but every time I look at macOS the wrong way something falls over. 'As a passionate Mac user, I'm continually disappointed in the security of macOS,' he said. He reported the bug to Apple earlier this month, 'but unfortunately the patch didn't make it into High Sierra,' he said, which was released Monday. 'If I was an attacker or designing a macOS implant, this would be the 'dump keychain' plugin,' said Wardle. That exploit could be included in a legitimate-looking app, or be sent by email. Wardle created a 'keychainStealer' app demonstrating a local exploit for the vulnerability, which according to the video, can expose passwords to websites, services, and credit card numbers when a user is logged in.
