![# BHASIA @BlackHatEvents
CVE-2023-27952 TCC bypasses via Safari
SandboxBroker
• Unzip process:
1.Will create a directory at ~/Downloads/[filename.zip].download and start writing the ZIP file into
this directory
2.Once downloaded, it will create a 6 character long random directory inside the previous one, e.g.:
~/Downloads/[filename.zip].download/abcdef
3.It will extract the contents of the ZIP file into this directory](https://image.slidesharecdn.com/asia-24-fitzl-wojciech-unlimited-ways-to-bypass-your-macos-privacy-mechanisms-240924105335-b8884da0/85/The-Final-Chapter-Unlimited-Ways-to-Bypass-Your-macOS-Privacy-Mechanisms-23-320.jpg)
![# BHASIA @BlackHatEvents
TCC bypasses via QuartzCore framework
It has a large attack surface for local attacks as it handles a lot of interesting environment
variables (please keep in mind that screen recording on macOS is TCC-restricted):
• CA_DEBUG_TRANSACTIONS
• CA_LOG_IMAGE_COPIES
• CA_DUMP_SURFACES_PER_DRAW
• CA_DUMP_SNAPSHOTS
• […]
• QUARTZCORE_LOG_FILE / X_LOG_FILE
• X_LOG_FILE_OPEN](https://image.slidesharecdn.com/asia-24-fitzl-wojciech-unlimited-ways-to-bypass-your-macos-privacy-mechanisms-240924105335-b8884da0/85/The-Final-Chapter-Unlimited-Ways-to-Bypass-Your-macOS-Privacy-Mechanisms-37-320.jpg)
The Final Chapter - Unlimited Ways to Bypass Your macOS Privacy Mechanisms
- 1. #BHASIA @BlackHatEvents THE FINAL* CHAPTER UNLIMITED WAYS TO BYPASS YOUR MACOS PRIVACY MECHANISMS CSABA FITZL & WOJCIECH REGUŁA
- 2. # BHASIA @BlackHatEvents NSFullUserName() – Wojciech Reguła • Head of Mobile Security @ SecuRing • Certified iOS Application Security Engineer (iASE) author • Focused on iOS/macOS #appsec • Blogger – https://wojciechregula.blog
- 3. # BHASIA @BlackHatEvents NSFullUserName() – Csaba Fitzl • Principal macOS Security Researcher @ Kandji • Former creator of macOS Exploitation & Pentesting Training • Ex red/blue teamer • 80+ CVEs from Apple • Blog: https://theevilbit.github.io/
- 4. # BHASIA @BlackHatEvents Our previous Black Hat TCC talks
- 5. # BHASIA @BlackHatEvents Agenda 1. TCC / Privacy fundamentals (quick recap) 2. TCC bypasses • Info leaks • Sysadminctl • com.apple.Safari.SandboxBroker • InstallAssistant.pkg • cpldiagnose • QuartzCore framework • CFNetwork • REDACTED 3. Dead and dying techniques 4. TCC / Security improvements in macOS Sonoma OpenAI: generate Polish and Hungarian grilling an apple
- 6. # BHASIA @BlackHatEvents TCC / privacy fundamentals
- 7. # BHASIA @BlackHatEvents TCC / Privacy fundamentals System Integrity Protection (SIP) • Based on Sandbox kernel extension • Restricts access to many directories on macOS • Denies debugger attachments to processes signed directly by Apple • Also known as rootless, because even root cannot do the above-mentioned operations when the SIP is turned on
- 8. # BHASIA @BlackHatEvents TCC / Privacy fundamentals Transparency, Consent & Control (TCC): • Protects users’ privacy • Not even root can approve TCC permissions • From macOS Ventura TCC protects also containers of sandboxed apps
- 9. # BHASIA @BlackHatEvents TCC / Privacy fundamentals The number of protected resources still increases…
- 10. # BHASIA @BlackHatEvents TCC / Privacy fundamentals
- 11. # BHASIA @BlackHatEvents TCC bypasses
- 12. # BHASIA @BlackHatEvents TCC bypasses via info leaks • Grepping since 2020. • Now Apple is grepping as well. :D • Still finding new data leaks, although not so much exposure as in the past. • Logs are the new place to grep! • Close to 30 leaks found. Minimum payout is 5k$. Do the math…
- 13. # BHASIA @BlackHatEvents Notable file system info leaks CVE-2023-23495 • ~/Library/SyncedPreferences/com.apple.kvs/com.apple.KeyValueService.EndToEndEnc rypted-Production.sqlite • Email addresses, known wifi hotspots CVE-2023-40395 • ~/Library/Caches/GameKit/Data/com.apple.gamecenter/en-GB- G:1437723026.gcdata/database.sqlite3 • Game center cache, contact info
- 14. # BHASIA @BlackHatEvents Notable file system info leaks • CVE-2023-38614 - com.apple.parsecd • Short lived session files (few mins) under ~/Library/Caches/com.apple.parsecd • Geolocation + keylogger!!!!!
- 15. # BHASIA @BlackHatEvents Notable log info leaks • CVE-2023-23505 - ScreenTimeCore
- 16. # BHASIA @BlackHatEvents Notable log info leaks • CVE-2023-40405 – Maps – distance to location, can geolocate the user!
- 17. # BHASIA @BlackHatEvents CVE-2023-40425 Enable private data in logs • Most private data in the logs are filtered as <private> • Can use a user profile to disable filtering – requires user interaction • But! We can set this directly in preferences
- 18. # BHASIA @BlackHatEvents TCC bypasses via info leaks • CVE-2023-32415 – open Weather && break Internet connection == profit 😂
- 19. # BHASIA @BlackHatEvents • CVE-2023-41072 contacts leak in iMessage TCC bypasses via info leaks
- 20. # BHASIA @BlackHatEvents CVE-2023-40424 TCC bypasses via sysadminctl || dscl • We can’t change HOME directory (=TCC bypass) • But we can create a new user with custom HOME directory with a custom TCC.db • In Ventura user’s TCC.db was “global” (e.g.: access to Documents = all users’ Documents) è Sonoma this is per user • Steps: 1. Create a custom TCC.db 2. Create a new user (or use root) with that DB 3. Login with the new user, access other users’ private data 4. Can be fully automated
- 22. # BHASIA @BlackHatEvents CVE-2023-27952 TCC bypasses via Safari SandboxBroker • /Applications/Safari.app/Contents/XPCServices/com.apple.Safari.SandboxBroker.xpc/ Contents/MacOS/com.apple.Safari.SandboxBroker • Used to extract ZIP files • Has FDA rights
- 23. # BHASIA @BlackHatEvents CVE-2023-27952 TCC bypasses via Safari SandboxBroker • Unzip process: 1.Will create a directory at ~/Downloads/[filename.zip].download and start writing the ZIP file into this directory 2.Once downloaded, it will create a 6 character long random directory inside the previous one, e.g.: ~/Downloads/[filename.zip].download/abcdef 3.It will extract the contents of the ZIP file into this directory
- 24. # BHASIA @BlackHatEvents CVE-2023-27952 TCC bypasses via Safari SandboxBroker • Exploitation process: 1. Create a large ZIP file - large files (slows down extraction) + custom TCC.db 2. Overwrite any ZIP file being downloaded 3. When the process creates the 6 character long directory, delete it, and place a symlink pointing to the TCC database folder. 4. Once extraction is complete, our TCC.db will be taken over.
- 27. # BHASIA @BlackHatEvents CVE-2023-42860 TCC (+SIP) bypasses via InstallAssistant.pkg • Apple signed pkg è will be installed with “SIP bypass rights” because of system_installd
- 28. # BHASIA @BlackHatEvents CVE-2023-42860 TCC (+SIP) bypasses via InstallAssistant.pkg • Scripts inside also run with the same right • Meet link_shared_support.bash • Target TCC.db or /Library/Apple/Library/Bun dles/TCC_Compatibility.bun dle/Contents/Resources/All owApplicationsList.plist
- 30. # BHASIA @BlackHatEvents TCC bypasses via cpldiagnose • cpldiagnose is a command line tool that diagnoses iCloud related services (mostly photos)
- 31. # BHASIA @BlackHatEvents TCC bypasses via cpldiagnose
- 32. # BHASIA @BlackHatEvents TCC bypasses via cpldiagnose
- 33. # BHASIA @BlackHatEvents TCC bypasses via cpldiagnose
- 34. # BHASIA @BlackHatEvents TCC bypasses via cpldiagnose
- 35. # BHASIA @BlackHatEvents TCC bypasses via cpldiagnose
- 36. # BHASIA @BlackHatEvents TCC bypasses via QuartzCore framework • QuartzCore is a standard, low-level framework built-in to macOS for processing and rendering graphical data. • macOS’ Core Graphic is based on the Quartz drawing engine. • Generally, it will be loaded by any native macOS app with GUI (Swift also)
- 37. # BHASIA @BlackHatEvents TCC bypasses via QuartzCore framework It has a large attack surface for local attacks as it handles a lot of interesting environment variables (please keep in mind that screen recording on macOS is TCC-restricted): • CA_DEBUG_TRANSACTIONS • CA_LOG_IMAGE_COPIES • CA_DUMP_SURFACES_PER_DRAW • CA_DUMP_SNAPSHOTS • […] • QUARTZCORE_LOG_FILE / X_LOG_FILE • X_LOG_FILE_OPEN
- 38. # BHASIA @BlackHatEvents TCC bypasses via QuartzCore framework
- 39. # BHASIA @BlackHatEvents TCC bypasses via QuartzCore framework
- 40. # BHASIA @BlackHatEvents TCC bypasses via QuartzCore framework This is OS command injection in all GUI macOS apps 😬
- 41. # BHASIA @BlackHatEvents TCC bypasses via QuartzCore framework • system() function will spawn a child process that will execute our command • TCC will then check who is responsible for the child process • The obvious answer here is – the parent process 😈
- 42. # BHASIA @BlackHatEvents TCC bypasses via QuartzCore framework
- 44. # BHASIA @BlackHatEvents TCC bypasses via CFNetwork • It respects an environment variable CFNETWORK_DIAGNOSTICS which when set – it makes the process logging every HTTP(S) request 😈
- 45. # BHASIA @BlackHatEvents TCC bypasses via CFNetwork • CFNetwork is another widely used framework for accessing network services and for handling changes in network configurations • Build on abstractions of network protocols to simplify tasks such as working with BSD sockets, administering HTTP and FTP servers, and managing Bonjour services • TLDR: The CoreServices framework has CFNetwork in its dependecies
- 47. # BHASIA @BlackHatEvents TCC bypasses via CFNetwork
- 48. # BHASIA @BlackHatEvents TCC bypasses via CFNetwork
- 49. # BHASIA @BlackHatEvents TCC bypasses via CFNetwork
- 50. # BHASIA @BlackHatEvents TCC bypasses via CFNetwork • Using the CFNetwork debug logging I was able to leak iCloud tokens • As I proved in talk “What happens on your Mac stays on Apple’s iCloud” it is possible to drain TCC-protected sensitive entries that are synchronized with iCloud
- 52. # BHASIA @BlackHatEvents Here you should see another serious TCC bypass … reported in January 2023 … which is still unfixed … which I told Apple in November I’d like to disclose at Black Hat Asia
- 53. # BHASIA @BlackHatEvents Dead & dying techniques
- 54. # BHASIA @BlackHatEvents Dead & dying techniques Mounting over directories • Most directories were protected against writing/reading, but not for mounting over • Mostly gone Sysadmin tools • Many sysadmin tools had extra rights • They were either removed or hardened Plugins • Launch Constraints killed most of these • Most other app signed with hardened runtime • Many helper tools exists (with no rights) to load 3rd party plugins
- 55. # BHASIA @BlackHatEvents Dead & dying techniques File system & log leaks • FS almost doesn’t exist anymore • Logs improve fast • App Data protection adds another layer of protection Installer script bugs • With “Install Script Actions & Mutations” mostly gone
- 56. # BHASIA @BlackHatEvents TCC improvements in macOS Ventura & Sonoma
- 57. # BHASIA @BlackHatEvents TCC improvements in macOS Sonoma/Ventura Launch Constraints (not TCC specific) Controls who and from where can launch an app (see: OBTS v6.0: Launch and Environment Constraints Overview), e.g.: • Can’t copy out Apple signed apps to /tmp/ or other places… • Can’t launch daemons from command line
- 58. # BHASIA @BlackHatEvents TCC improvements in macOS Sonoma/Ventura Application bundle and data protection • Bundle protection since Ventura • App data protection since Sonoma • Breaks lots of info leaks • Nice effort… too bad it’s trivial to bypass both Overall 16 new TCC categories since Monterey
- 60. # BHASIA @BlackHatEvents Summary • TCC is Apple’s attempt to protect private data • Definitely a good idea • In the past 5 years it evolved and improved a lot • It’s getting harder to find bypasses, especially generic • Yet, just 2 of us managed to find so many bugs that filled 3 entire conference talks – and there are a ton of others
- 61. # BHASIA @BlackHatEvents Did we say Final chapter? Yes! It has been a great journey.
- 62. # BHASIA @BlackHatEvents There is one more thing…
- 63. # BHASIA @BlackHatEvents The ”Return to TCCland” Sequel is under heavy development 🤣
- 64. # BHASIA @BlackHatEvents Where We bypass AllTheThings Again… Again… And Again... 🤣
- 65. # BHASIA @BlackHatEvents World Premier: 2025
- 66. # BHASIA @BlackHatEvents THANK YOU!