Hacker News Reader

Comment by pilsetnieks | Hacker News Reader

If this is how it works, you can check it on OS X by clicking each item in Keychain Access and looking at the Access Control tab or you can run `security dump-keychain -a` in terminal - it lists all keychain items and their access control lists. It's still a big and unwieldy list but not as bad as clicking each keychain item. Someone better at this stuff could probably think of a way to make it easier.

(This would only show if you've been exploited already, not that some app is capable of doing it.)

View on HN

The results are pretty unwieldly if you have a lot of passwords so I used the following snippet to sift through the crud

  cat results.txt | grep -A 20 'applications' |grep \[0-9\]: | grep -v entry | grep -v description | cut -d\  -f14- |  sort | uniq

I made a couple of assumptions so YMMV:

  - up to 10 apps in the ACL ( the max I saw in mine was 7 )

  - the word 'entry' or 'decription' was no present in the app name

Here is a more comprehensive one-liner to see all items with more than 1 applications on a ACL list:

    security dump-keychain -a > keychain-results.txt

    grep -P '(^(class|keychain):|\s+("(svce|acct)"|0x0000000(1|7)) <blob>="[^"]*"|^\s+applications \(([2-9]|[0-9]{2,})\):|^\s+[0-9]+:)' keychain-results.txt | \
    perl -pe 's/\n/\0/g' | perl -pe 's/\0keychain:/\nkeychain:/g' | \
    grep -aP 'applications \(([2-9]|[0-9]{2,})\):' | \
    sort -u | perl -pe 's/\0/\n/g'

>This would only show if you've been exploited already

What would indicate a compromise?

If the ACL of a keychain item contains an app that isn't supposed to have access to that keychain item then that would indicate a compromise.

Ah ok that makes sense. Thanks very much.

I'm curious: do you have any idea why after running this command would security start asking for password for various keychains?

It goes over all keychains so I'm assuming (at least it was so for me) that it asked for password for locked keychains.

`security` is a built-in system utility, basically Keychain Access for terminal, the same way that `diskutil` is Disk Utility but in the terminal.

Reply on news.ycombinator.com