MAC OS X Forensics: Password Discovery

OS X provides a password-rich environment in which passwords protect OS X resources and perhaps many other resources accessed through OS X. Every password an investigator discovers in an OS X environment has the potential for use in discovering other such passwords, and any discovered passwords may also be useful in other aspects of an investigation, not directly related to the OS X environment. This research advises the use of multiple attack vectors in approaching the password problem in an OS X system, including the more generally applicable non-OS X-specific techniques such as social engineering or well-known password cracking techniques such as John the Ripper or other versions of dictionary attacks and Rainbow table attacks. In some successful approaches the components of the attack vector will use more OS X specific techniques such as those described here: application-provided password revealing functions, a Javascript attack, an “Evil Website” attack, system file scavenging, exploitation of the keychain, and an OS X install disk attack. Keywords: OS X, password, password discovery, social engineering, sleepimage, keychai