Month: September 2017

(credit: Koichi Taniguchi)

There's a vulnerability in High Sierra and earlier versions of macOS that allows rogue applications to steal plaintext passwords stored in the Mac keychain, a security researcher said Monday. That's the same day the widely anticipated update was released.

The Mac keychain is a digital vault of sorts that stores passwords and cryptographic keys. Apple engineers have designed it so that installed applications can't access its contents without the user entering a master password. A weakness in the keychain, however, allows rogue apps to steal every plaintext password it stores with no password required. Patrick Wardle, a former National Security Agency hacker who now works for security firm Synack, posted a video demonstration here.

The video shows a Mac virtual machine running High Sierra as it installs an app. Once the app is installed, the video shows an attacker on a remote server running the Netcat networking utility. When the attacker clicks "exfil keychain" button, the app surreptitiously exfiltrates all the passwords stored in the keychain and uploads them to the server. The theft requires no user interaction beyond the initial installation of the rogue app, and neither the app nor macOS provides any warning or seeks permission.

Enlarge (credit: SAG-AFTRA)

Eleven months of haggling between striking voice actors and video game producers appear to finally be over, according to an announcement from acting union SAG-AFTRA issued on Monday. The strike's biggest sticking point, regarding "secondary compensation" (aka royalties or residuals), appears to favor game publishers, not actors.

SAG-AFTRA's statement confirmed that the two sides have tentatively agreed to a "new bonus structure" that will pay games' union-member voice actors additional cash if the game they worked on sees commerical release. This sliding-scale bonus payment appears to be firm for all actors, with a single voice-acting "session" earning an actor an additional $75 and up to $2,100 if the actor worked at least 10 sessions for the game in question. (The meaning of "session" was not clarified.)

This differs from SAG-AFTRA's original demand of royalty payments based on a game's sales. The union's proposal sought a royalty for voice actors whose games exceeded 2 million copies of sales, with more royalties kicking in at the 4, 6, and 8 million sales levels. SAG-AFTRA never went public with the payment amounts they sought for those sales levels, so it's unclear how much less (or more) game publishers will pay out for this flatter, "if a game comes out at all" bonus system.