2

I'm a newb of OS X (or any flavor of *Nix for that matter) so this came to mind lately.. As the Console.app logs every single process that's running, does to also mean passwords & such are also logged aside from Keychain?

I noticed for example, when creating a Workflow in Automator and telling it to follow your moves; it will also log any password you enter along the way in plaintext..

Is this the case, and if so, isn't this a security risk?

Thx in advance!

|improve this question
  • 1
    Technically console.app looks at files. It could look at a word doc, except for the formatting would be foreign to it as it prefers text files and standard unix compression utilities. The real issue is which programs might store and log a password in plain text form. – bmike♦ Dec 15 '12 at 15:51
  • 1
    Yes this is a security risk. But Console.app isn't the culprit but a witness. – dan Dec 17 '12 at 10:00
2

No, Console won’t log any of your passwords. It only logs normal process activity like load, errors, warnings, etc.

Certain user activity that can causes a major change in the program’s behaviour will also be logged. Opening and saving documents is one such activity.

Automator logs your password because it doesn’t know you are entering your password; it only knows that keyboard input is being received. Recording actions in Automator is very literal. It records the points being clicked, not the buttons. It records the delay between two actions; it does not detect if a previous action has completed or not. Similarly, it records the buttons being pressed, not what those buttons do or even if the key presses are for a text field or a game.

|improve this answer
2

The answer is 2 sided.

  1. No Console.app doesn't log anything. Console.app simply display logfiles feeded by applications and MacOS X itself.

  2. Yes you can see clear text password logged with Console.app.

How such a password disclosure may happen?

Here are the causes by order of decreasing probability:

  1. I inadvertantly typed my password within an admin right checking window.

    I didn't notice that this window was first asking me an admin account and I typed there my password. This one is duly registered in /var/log/secure.log as if it is an admin account.

  2. I typed my password within a badly conceived software which will log it in /var/log/system.log with some other pieces of information. This may be due to either an internal debugging function or a tracking function.

    Keyboard sniffers and RATs are some dangerous piece of software which see passwords in clear (they may even see much more confidential pieces of information). Hence they must be very carefully coded so as to avoid any leak of the information they see.

In case n° 1: you just have to change it and do the same change wherever you used the same password. In case n° 2: same corrective action concerning your disclosed password. And you could signal the problem to the author of the software if you think they are among the software editors who may understand and fix this security vulnerability.

|improve this answer
1

Console.app shows what processes have written to files or syslog or the Apple logger. What gets written there depends on the application and what the developers have decided to write. I have seen apps where bad developers have left debug logging in but these are very rare.

If the developers use the Apple authentication framework to get a password for an admin user then the application does not see the password so the application cannot write it to a log.

As @duci9y says Autimator does not know that this is a password and so just treats it like any text, writing it to stdout.

|improve this answer
0

No, Console.app does not log passwords in plaintext.

|improve this answer
  • Automator does not seem to log entered text to stout, and therefore entered text does not show up in Console.app. Even if you change the workflow->Contents->document.wflow to document.txt, entered text is still not stored in plaintext. The only way to get entered text from a recorded workflow aside from actually running the workflow is by looking at workflow->Contents->Resources->Thumbnail.png as it is a thumbnail of the automator action. – David Holdeman Dec 16 '12 at 0:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .