Lock Picking the macOS Keychain

The talk looks at the macOS keychain, the place where the operating system and applications store passwords, keys, certificates and other secrets on a user's behalf. The speaker explains that the file-based keychains on disk are a frequent red team target. Their contents stay encrypted, but an attacker who obtains the user's plaintext password can decrypt them offline. The goal presented is to extract secrets without ever touching the file or triggering a user prompt.

Each keychain item pairs encrypted data with readable metadata and an access control list that names trusted applications and the operations they may perform. The speaker walks through how the partition ID field ties an entry to a team ID or to Apple-signed binaries, and how the security command line tool and the Security framework search and export functions behave. A practical route emerges: code running inside an Apple-signed scripting host can meet the partition requirements and read entries silently. The talk then covers three case studies. Microsoft Office stored cached access tokens in an unencrypted general attribute. Slack's safe storage key was guarded by a requirement string that did not pin a version, so an older signed build could be abused. The local Kerberos key distribution center keys on each Mac could be exported as root without prompts, which would allow forging tickets.

The closing takeaways are that secrets should not be placed in general attributes, that code requirements should be pinned to specific versions, and that defenders should consider rotating local Kerberos credentials after a Mac compromise. The speaker also released open-source tools for enumerating and dumping keychain entries.