engleski

Forensic analysis of the Mac OS X keychain

Keychain is Apple Inc.’s password management system in Mac OS X. A Keychain can contain various types of data: passwords (for Websites, FTP servers, SSH ac- counts, network shares, wireless networks, groupware applications, encrypted disk images), private keys, certificates, and secure notes. By analyzing and decrypting the keychain file it is possible, in most cases, to gain access to every secret information a user has, and as such it represents a critical component of the operating system. Research the Mac OS X keychain. Describe the keychain file format. Analyze used cryptographic functions. Describe possible vulnerabilities and attacks on the keychain file. Propose future improvements for security hardening.

Mac OS X; keychain; security; cryptography; forensics

nije evidentirano