20+ ways to bypass your mac os privacy mechanisms
- 1. 20+ Ways to Bypass Your macOS Privacy Mechanisms Wojciech Reguła & Csaba Fitzl #BHUSA @BlackHatEvents
- 2. #BHUSA @BlackHatEvents Whoami - Csaba • Author of “macOS Control Bypasses” training @ Offensive Security • Developer of Shield.app – exploit protection for macOS • Ex red and blue teamer • Husband, father • Hiking
- 3. #BHUSA @BlackHatEvents Whoami - Wojciech • Senior IT Security Consultant @ SecuRing • Focused on iOS/macOS #appsec • Blogger – https://wojciechregula.blog • iOS Security Suite Creator • macOS environments security
- 4. #BHUSA @BlackHatEvents Agenda 1. Introduction to macOS Privacy 2. TCC bypasses through: • plugins • process injection • mounting • app behavior • /usr/bin/grep 3. Our thoughts on the Apple Security Bounty 4. Conclusion
- 5. #BHUSA @BlackHatEvents Intro – macOS Security Mechanisms System Integrity Protection (SIP): • Based on Sandbox kernel extension • Restricts access to many directories on macOS • Denies debugger attachments to processes signed directly by Apple • Also known as rootless, because even root cannot do the above-mentioned operations when the SIP is turned on
- 6. #BHUSA @BlackHatEvents Transparency, Consent, and Control (TCC)
- 7. #BHUSA @BlackHatEvents Transparency, Consent, and Control (TCC)
- 8. #BHUSA @BlackHatEvents Transparency, Consent, and Control (TCC) • SQLite3 Database • /Library/Application Support/com.apple.TCC • ~/Library/Application Support/com.apple.TCC
- 11. #BHUSA @BlackHatEvents Transparency, Consent, and Control (TCC) • User Intent • Extended attribute: com.apple.macl • Managed by the Sandbox • Can’t be added/deleted
- 12. #BHUSA @BlackHatEvents Transparency, Consent, and Control (TCC)
- 13. #BHUSA @BlackHatEvents Transparency, Consent, and Control (TCC) • com.apple.macl • Header • UUID
- 14. #BHUSA @BlackHatEvents TCC bypasses through plugins • TCCd validates entitlements held by the main executable • Plugins execute code in the context of the main application • So, plugins inherit the private tcc entitlements
- 15. System app with plugin TCC daemon Kernel
- 16. System app with plugin TCC daemon Kernel I want to access files from Desktop
- 17. System app with plugin TCC daemon Kernel I want to access files from Desktop Hey TCC, check the permissions of the requesting app
- 18. System app with plugin TCC daemon Kernel I want to access files from Desktop Hey TCC, check the permissions of the requesting app Validate Code Signing requirement
- 19. System app with plugin TCC daemon Kernel I want to access files from Desktop Hey TCC, check the permissions of the requesting app Validate Code Signing requirement Access Granted
- 20. System app with plugin TCC daemon Kernel I want to access files from Desktop Hey TCC, check the permissions of the requesting app Validate Code Signing requirement Access Granted Access Granted
- 21. System app with malicious plugin
- 22. System app with plugin TCC daemon Kernel I want to access files from Desktop Hey TCC, check the permissions of the requesting app Validate Code Signing requirement Access Granted Access Granted
- 23. #BHUSA @BlackHatEvents Changing NFSHomeDirectory aka CVE-2020-27937 TCC bypasses through plugins
- 24. #BHUSA @BlackHatEvents Changing NFSHomeDirectory aka CVE-2020-27937 TCC bypasses through plugins
- 29. #BHUSA @BlackHatEvents TCC bypasses through plugins Changing NFSHomeDirectory aka CVE-2020-27937 1. Copy Directory Utility to location not protected by the SIP 2. Inject a malicious plugin that will be executed with the Directory Utility’s private TCC entitlements 3. Prepare a fake TCC SQLite3 database with fake permissions 4. Modify the NFSHomeDirectory 5. Restart TCCd, so it will load our fake database basing on the NFSHomeDirectory 6. Full user TCC bypass achieved 😎
- 31. #BHUSA @BlackHatEvents Full TCC bypass via coreaudiod aka CVE-2020-29621 TCC bypasses through plugins
- 32. #BHUSA @BlackHatEvents Full TCC bypass via coreaudiod aka CVE-2020-29621 1. Create a malicious macOS bundle with “.driver” extension 2. Plant it in /Library/Audio/Plug-Ins/HAL/ 3. Restart the coreaudiod 4. We can now fully control TCCd 😎 TCC bypasses through plugins
- 33. #BHUSA @BlackHatEvents Full TCC bypass via coreaudiod aka CVE-2020-29621 TCC bypasses through plugins
- 35. #BHUSA @BlackHatEvents TCC bypasses through process injection Injecting to xsanctl aka CVE-2020-10006: • We execute code again in the context of an entitled application • However you cannot inject to Apple’s signed apps • But there are exceptions… com.apple.security.get-task-allow 😎
- 37. #BHUSA @BlackHatEvents TCC bypasses through process injection • 3rd party apps are especially vulnerable to this kind of attacks • If you manually give the vulnerable app TCC permissions, malware can abuse that app • Electron apps are vulnerable by default 😅 • We have found such vulnerabilities in many apps including: o Firefox (0day / won’t fix) o StreamLabs OBS (0day / won’t fix) o Signal (CVE-2020-24259, fixed) o Snaglt (fixed)
- 39. #BHUSA @BlackHatEvents TCC bypasses through mounting CVE-2020-9771 - mount_apfs TCC bypass • APFS supports snapshots • Mount the snapshot in custom location • Access all files (read-only) • Mount with ”noowners” à access every user’s files • FIX: requires Full Disk Access 😭
- 40. #BHUSA @BlackHatEvents TCC bypasses through mounting CVE-2021-1784 - TCC bypass via disk mounting • User’s TCC DB file is protected • But! We can mount over the directory • Prepare a new TCC.db file, new disk image • Mount over “~/Library/Application Support/com.apple.TCC” • Profit 🤑
- 42. #BHUSA @BlackHatEvents TCC bypasses through app behavior • Some apps can access private files • Some apps move files when they do something • Some apps can do both
- 43. Malicious app App with access to private files
- 44. Hi app! I see you can access XYZ private files. Yes! Why? Could you move those files for me to location ABC?
- 45. Of course! Here they are. Thank you! Anytime! It was my pleasure.
- 46. #BHUSA @BlackHatEvents TCC bypasses through app behavior CVE-2021-30751 – Notes.app • Open files with notes -> auto attach to notes • Notes are unprotected
- 47. #BHUSA @BlackHatEvents TCC bypasses through app behavior CVE-2021-30751 – Notes.app
- 48. #BHUSA @BlackHatEvents TCC bypasses through app behavior CVE-2021-XXXX – App translocation • Makes NULLFS mount (not copy) when downloaded app first run • Destination: $TMPDIR/AppTranslocation/d/d/Some.app • Open source as part of Security. • Library: libsecurity_translocate • Binary: /usr/libexec/lsd
- 49. #BHUSA @BlackHatEvents TCC bypasses through app behavior CVE-2021-XXXX – App translocation • Add Quarantine attribute to “Library” • Call the com.apple.security.translocation XPC service • (XPC client is also open source) • Map Library to $TMPDIR/AppTranslocation/d/d/Library • Access all files
- 50. #BHUSA @BlackHatEvents TCC bypasses through app behavior CVE-2021-XXXX – App translocation
- 52. #BHUSA @BlackHatEvents TCC bypasses with /usr/bin/grep 😅 • Private info is everywhere • Various DBs, caches, configuration files – keep / leak bits of info • How to find them? grep to the rescue 🤣
- 53. #BHUSA @BlackHatEvents TCC info leaks • CVE-2020-9963 - QuickLook thumbnails DB (filenames) • CVE-2021-1803 - CloudDocs DBs (filenames) • CVE-2021-1781 - UITextInputContextIdentifiers.plist (contacts) • CVE-2021-XXXX - com.apple.identityservices.idstatuscache.plist (contacts) • CVE-2021-30750 - Recents database (contacts)
- 54. #BHUSA @BlackHatEvents TCC info leaks • CVE-2021-XXXX - CircleCache.plist (family contacts, birth date) • CVE-2021-XXXX - knowledgeC.db (full iMessages, contacts, etc..) • WON’T FIX - Quarantine database (full download history) • And many more… (yet to be fixed)
- 55. #BHUSA @BlackHatEvents Apple Security Bounty (ASB) https://developer.apple.com/security-bounty/payouts/
- 56. #BHUSA @BlackHatEvents Apple Security Bounty (ASB) • Apple pays what promised • Bug fixes are often slow – especially design issues • Some reports will be fixed in Monterey only, although they were reported in Catalina à 2 major OS versions!! • Lack of communication, often no updates for months • ASB eligibility decision timeline is unacceptable, often more than 6-7 months!!!
- 57. #BHUSA @BlackHatEvents Conclusion • We appreciate the effort • Step in the right direction • Other vendors should do the same • Still lots of issues 1. Apple’s binaries have too many exceptions 2. Third parties are vulnerable to injection attacks • ASB has to improve