keychain password lost (owner is passed away)

Question

Level 1

9 points

keychain password lost (owner is passed away)

Hello

a dear friend is passed away and her sister asked me help about his mac.

We discovered that my friend had a relevant amount of money on bitcoin and she doesn't even know what bitcoin is. I also found that account information on bitcoin and other information are all present on the secure note on keychain of his macbook air (mountain lion)

We have all the legal documents to demonstrate what I'm saying above so I'm not trying to do something illegal.

Is there a possibility to contact Apple and have help on the matter?

We are also trying to discover and/or crack the account password but it would be ideal to have apple involved on this.

Thank you in advance

Max

PS: we have two macs with same data. On the first I changed the admin password but the keychain password remain the old one (as reported on apple documentation). I already found a little c program that can discover the masterkey of keychain but only if already logged with the account, and we don't have any of the mac already logged in with that account. In addition to this we don't have on the two macs any admin account expect the one of my friend.

MacBook Air, iOS 6.1.4

Posted on May 23, 2013 6:46 AM

Reply

Answer 1

May 23, 2013 6:50 AM in response to maxorso

Nope! Without the keychain password it's impossible to unlock it. The contents of this file are encrypted and require the password to view.

Reply

Answer 2

maxorso Author

Level 1

9 points

May 23, 2013 6:53 AM in response to Topher Kessler

Yes I know this.

Cracking the user password on the other mac for example give us the possibility to log on with the account (I'm also investigating if with "Jack the ripper" is feasible to discover the password).

Anyway what I'm asking is a way to ask this directly to Apple obviously sending them all the legal documentation.

Thank anyway

Reply

Answer 3

May 23, 2013 6:59 AM in response to maxorso

You can try contacting Apple, but its employees will be met with the same blocks as anyone else. Apple does not have special tools for unlocking a keychain's encryption, but you can definitly ask them. However, given the current state of the system and situation surrounding it, you will not be able to get the keychain password back.

Reply

Answer 4

Eric Root

Level 10

685,227 points

May 23, 2013 1:37 PM in response to maxorso

Is there a backup of this computer, that is hopefully relatively new? If so, you could erase the computer, reinstall the OS (you may have to purchase it again), set up a new account(s) and then use Setup Assistant to import from the backup. There may be some permissions problems, but it should be possible to fix them.

Reply

Answer 5

maxorso Author

Level 1

9 points

May 23, 2013 4:48 PM in response to Topher Kessler

@TopHer

Yes you're right but maybe they have special tools. Anyway they have deeper knowledge about code underlying keychain so they have some advantages vs us.

Can you sugget me how to contact Apple? I think that the normal support can't be helpful... No apple emplyees reading this forum?

@Eric

We do have a lot of backup, my friend was an excellent IT worker. Have you tried this method before?

I'm asking this becouse it doesn't seem to me a feasible way to recover the information contained in the secure note on keychain. To me this process implies the loss of the original account password, so how can the mac knows how to decrypt the keychain file?

Reply

Answer 6

etresoft

Level 9

56,338 points

May 23, 2013 5:09 PM in response to maxorso

That's why people should deposit their money with banks instead of hackers. The money is gone. The keychain is encrypted. Erase the hard drive and sell the machine at an estate sale. That is all you will ever get. Move on.

Reply

Answer 7

g_wolfman

Level 4

3,472 points

May 23, 2013 7:38 PM in response to maxorso

Unfortunately, the fact that Apple knows the Keychain code is irrelevant. One of the fundamental principles of cryptography is that the encryption should be dependent only on the cryptographic keys, not the algorithm used to generate the encryption.

If your friend chose a particularly bad key (ie, password), then maybe a tool like John could crack it; but if he was a competent IT professional, as you suggest, then how likely is that?

Maybe Eric Root's solution is feasible; most likely the information is gone, and the BitCoin account effectively gone with it.

Reply

Answer 8

May 23, 2013 8:17 PM in response to maxorso

Yes you're right but maybe they have special tools. Anyway they have deeper knowledge about code underlying keychain so they have some advantages vs us.

Can you sugget me how to contact Apple? I think that the normal support can't be helpful... No apple emplyees reading this forum?

Honestly you will be wasting your time. While Apple coded the keychain, cryptography by default is intended so even the developer cannot unlock your files without the proper password. This security is the goal of the developer, and if workarounds or hacks are found then the developer has failed.

I'm not sure how to contact anyone but standard Apple support, and even if you do get ahold of an engineer, my guess is they will refer you back to standard support (if they respond at all).

Reply

Answer 9

Feb 6, 2014 3:00 AM in response to maxorso

I suspect there will be a cold storage or paper wallet backup of his bitcoins somewhere. Look in the vault. USB sticks or paper with QR codes could be it.

Reply