The concept of a “sandbox” has two popular interpretations. The first is a protected ecosystem that partially restricts user actions to guarantee a level of experience, and the second is a virtual container that keeps programs isolated. Users want to escape the first box, but they never want the second one to fail… and that is exactly what a group of researchers from Indiana University caused on iOS and OS X.
Sandboxes are a solid security resource as long as they are well implemented. We all know quite well that some applications let demons escape everywhere. We have reported vulnerabilities in modules like Adobe Flash Player to the point of boredom, and web browser developers had no choice but to “lock it up” so it doesn't cause problems. Sandboxing is even stricter on mobile devices, but in general, the work of researchers looking for bugs in them is highly appreciated.
The latest example comes from members of Indiana University, Peking University, and the Georgia Institute of Technology. This group managed to create custom applications capable of extracting information stored in services like 1Password and iCloud, but they made them in such a way that they were even approved for distribution in Apple's store. One of the attacks was concentrated on 1Password, the most popular security option in the store, and the third most downloaded application there. 1Password offers an extension for every major browser with the aim of coordinating the user's connection, a function that requires the transmission of the password through a WebSocket connection. In simple terms, the malicious application creates a WebSocket server that takes control of port 6263 before 1Password does, thus allowing the extraction of the password when the user accesses 1Password via the web.
Another of the applications exploits a design flaw in OS X's keychain, manipulating attributes for applications that have not yet been installed by the user. If later the user decides to add a copy of those applications to their system, the malicious program will have full access to the credentials, and if the keychain entry already exists, the malicious program has the resource of resetting the password, forcing the user to enter it, which leads to its interception. The vulnerabilities have already been reported, and in essence, all the user has to do is wait for Apple to update the affected code. Now, although the problem reaches Apple's operating systems, that does not mean it is exclusive to them. The weaknesses in WebSocket could also be exploited on Windows systems if the necessary conditions are met.
