Protecting the macOS Keychain from Credential Theft (T1555.001)

The macOS Keychain holds account names, passwords, private keys, certificates, application data, payment data and secure notes. MITRE ATT&CK technique T1555.001, Keychain, covers adversaries acquiring credentials from it. The tactic is credential access and the platform is macOS.

How attackers use it

MITRE describes three keychain types: the Login Keychain, which is the default and stores user passwords and information, the System Keychain, which holds items used by the operating system and shared among users, and the Local Items (iCloud) Keychain for items synced with iCloud.

Keychains can be viewed and edited through the Keychain Access application or the security command line utility. Files live in ~/Library/Keychains/, /Library/Keychains/ and /Network/Library/Keychains/.

An adversary may gather credentials from keychain storage or memory. MITRE's example is the security dump-keychain command, which can dump all Login Keychain credentials, or reading the Login Keychain file directly. Both methods need a password. By default, that password is the current user's login password for the Mac.

That last detail is the defensive opening.

How to detect it

MITRE lists no data sources here. Watch for the security utility run with keychain dump or export style arguments, especially from scripts or unusual parent processes, and for non-system processes reading files under the Keychains directories. Endpoint telemetry that records process creation and file access on macOS is the main source.

How to reduce the risk

MITRE's mitigation is password policy: the password for the user's login keychain can be changed so that it differs from the login password. An adversary who obtains the login password then still lacks the keychain password, which adds a step. Combine that with a strong, unique login password and disk encryption.

Quick check

Sources

• MITRE ATT&CK T1555.001 Keychain