Keychained Melody Grabbing the Keys to the iCloud Kingdom

The talk opens with how Apple protects iCloud Keychain. Secrets sync only among devices in a trust structure that has grown from a simple circle into a graph called Octagon, and the keys guarding them are rooted in the Secure Enclave. The presenters argue that infostealers now routinely take local keychains, which makes the iCloud copy the more personal prize. They set out to test whether an attacker already running code on a Mac could reach it.

The core flaw sits in the trusted peers helper daemon, which keeps the list of devices allowed to read the data. By injecting an attacker-generated key pair into that database, the attacker got the daemon to treat that identity as trusted. During an automatic repair, the daemon re-encrypted the top-level keys to the attacker's key. The demo needed no root, no user password and no prompts. It recovered saved passwords, Wi-Fi credentials and stored cards. Matter home keys also unlocked a smart lock, and passkey-protected logins could be replayed. A second bug let iCloud backups hold an escrow secret protected only by a device-bound key, so a wiped phone could still yield data.

Apple patched both issues under CVE-2026-28860, and the presenters withheld proof-of-concept code. Their takeaways are to watch the trusted peers database for unexpected writes, since legitimate changes are rare, and to avoid reusing passwords across accounts. They also described an undocumented CloudKit reset command for compromised accounts, with a warning that it can cause data loss.