Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1555.002_securityd-memory
An adversary with root access may gather credentials by reading `securityd`’s memory.
Passed 20 of 25 test cases with the skill, and 10 of 25 without it.
and 9 more in the full report
10 fixed10 passed either way5 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 10 test cases the skill fixed. Same model, same prompt, with and without the skill.
Identify the parent MITRE ATT&CK technique code for the securityd memory sub-technique.
| Checked | Without skill | With skill |
|---|---|---|
| identifies T1555 as the parent technique | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1555
An adversary with root access may gather credentials by reading securityd’s memory. securityd is a service/daemon responsible for implementing security protocols such as encryption and authorization. A privileged adversary may be able to scan through securityd's memory to find the correct sequence of keys to decrypt the user’s logon keychain. This may provide the adversary with various plaintext passwords, such as those for users, WiFi, mail, browsers, certificates, secure notes, etc.
In OS X prior to El Capitan, users with root access can read plaintext keychain passwords of logged-in users because Apple’s keychain implementation allows these credentials to be cached so that users are not repeatedly prompted for passwords. Apple’s securityd utility takes the user’s logon password, encrypts it with PBKDF2, and stores this master key in memory. Apple also uses a set of keys and algorithms to encrypt the user’s password, but once the master key is found, an adversary need only iterate over the other values to unlock the final password.
Platforms: Linux, macOS
Identify Attack Surface: Determine if the target environment is susceptible to Securityd Memory by examining the target platforms (Linux, macOS).
Assess Existing Defenses: Review whether mitigations for T1555.002 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
No specific mitigations documented for this technique.
test cases passed, vs 10 / 25 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.