Download as PDF, PPTX
More Related Content
Similar to Mitigating Exploits Using Apple's Endpoint Security
![Support, Monitoring, Continuous Improvement & Scaling Agentic Automation [3/3]](https://cdn.slidesharecdn.com/ss_thumbnails/agenticcommunityseries-day3-cfd-251120170304-ddef8112-thumbnail.jpg?width=640&height=640&fit=bounds)
Mitigating Exploits Using Apple's Endpoint Security
- 1. Mitigating exploits using Apple'sEndpoint Security Csaba Fitzl Twitter: @theevilbit
- 2. whoami • author of"macOS Control Bypasses" @ Offensive Security • ex red/blue teamer • macOS researcher • husband, father • hiking 🥾 🏔 • yoga 🧘
- 3. agenda 1. process injectionattacks 2. symlink attacks 3. Endpoint Security framework 4. developing the app 5. the app's logic 6. demos
- 4.
- 5. why important? • processinjection is a big ⛔ on macOS • access to process's privileges • TCC • keychain • impersonate XPC client (XPC LPEs) • impersonate KEXT client
- 6. DYLD_INSERT_LIBRARIES • classic • SIPkills it (hardened runtime, platform binaries) • still can enable it with entitlement -> if possible don't 🙏
- 7. DYLIB hijacking andproxying • discussed in detail by Patrick Wardle in 2015 • plant a dylib the app looks for, or replace one with your own • SIP / library validation kills it • still can enable it with entitlement -> NOOOO!!!! • problem: app needs to support 3rd party plugins => bypass TCC (Apple & 3rd parties)
- 8. task for pid •inject by getting the task port • ⚠ debug builds with bad entitlement ⚠ • SIP kills this • notarization checks for `com.apple.security.get-task-allow`
- 9. Electron • so muchbroken • env vars • debug ports
- 10. vulnerabilities • CVE-2020-26893 -ClamXAV AntiVirus XPC LPE • CVE-2020-29621 - coreaudiod TCC bypass • CVE-2020-25736 - Acronis True Image 2021 XPC LPE • CVE-2020-24259 - Signal macOS TCC bypass • CVE-2020-14978 - F-Secure XPC • ...
- 11.
- 12. the approach • processrunning as root writes or modi fi es fi les at a user controllable location • place a symlink or hardlink, pointing to a root accessible location
- 13. vulnerabilities • CVE-2020-9900 -Crash Reporter LPE • CVE-2021-1786 - Crash Reporter arbitrary fi le deletion • CVE-2020-3855 - macOS DiagnosticMessages arbitrary fi le overwrite • CVE-2020-3762 - Adobe installer LPE • ...
- 14. MACF - Mandatory Access ControlFramework
- 15. MACF • origin: TrustedBSDMAC • implemented in kernel • policy modules extend the kernel • can place hooks in supported location • very powerful
- 16. MACF • very -very powerful • was part of KDK till OS X 10.12 (never of fi cially supported) • mac.h header was removed • available in xnu: `security/mac.h`, `security/mac_framework.h` • examples: AppleMobileFileIntegrity, Sandbox, EndpointSecurity, Quarantine (=Gatekeeper)
- 17. MACF • typical calloutfrom xnu: mac_......
- 18.
- 19. MACF • MAC_CHECK • iteratesover all policy frameworks • mpo_... (mac_policy.h)
- 20.
- 21. ES • KEXT -MACF, kauth • dylib - C API for clients • endpointsecurityd - loading SEXT via launchd • sysextd - validation and copy • SystemExtension.framework - activation and deactivation of the extension • systemextensionsctl - basic control of sysxextd • more: Scott Knight's OBTS talk 1: Scott Knight, https://knight.sc/reverse%20engineering/2019/10/31/macos-catalina-privilege-escalation.html
- 22. ES • MACF policy(EndpointSecurity) • ~60 hooks
- 23. ES • user modeevents are mapped to kernel MACF hooks • examples: • ES_EVENT_TYPE_NOTIFY_CHROOT - es_vnode_check_chroot • ES_EVENT_TYPE_NOTIFY_MOUNT - es_mount_check_mount_late • ES_EVENT_TYPE_NOTIFY_MMAP - es_ fi le_check_mmap • ES_EVENT_TYPE_AUTH_GET_TASK - es_proc_check_get_task
- 24. ES • very powerful!!! •extending MACF to user mode • MACF was never of fi cially supported • now we have in user mode ❤
- 25.
- 26.
- 27. getting entitled • 2020March - requested ES entitlement • 2020 April - got developer version • 2020 - emails going to "black hole" at Apple • ... • 2021 January - got the entitlement • frustration, demotivation, annoyed, extremely bad experience - luckily I don't do this for living
- 28. sources • used PatrickWardle's ProcessMonitor and FileMonitor • also reviewed Stephen Davis’s Crescendo
- 29.
- 30.
- 31. ES_EVENT_TYPE_AUTH_EXEC • checks: • argument •--inspect, --inspect-brk, --remote-debugging-port • environment variables • DYLD_INSERT_LIBRARIES • CFNETWORK_LIBRARY_PATH • RAWCAMERA_BUNDLE_PATH • ELECTRON_RUN_AS_NODE
- 32.
- 33. ES_EVENT_TYPE_AUTH_MMAP • dylib injectionprotection • "enforce" library validation • slow - disk I/O
- 34. ES_EVENT_TYPE_AUTH_LINK • event forhardlinks • low privilege process isn't allowed to point to high privilege location
- 35. ES_EVENT_TYPE_NOTIFY_CREATE • track symboliclinks • low privilege process isn't allowed to point to high privilege location • detect only - don't know the target before creation
- 36. demo - w/oShield CVE-2020-26893 - ClamXAV AntiVirus XPC LPE
- 37.
- 38. demo - w/Shield CVE-2020-26893 - ClamXAV AntiVirus XPC LPE
- 40. wrap up • injectionand fi le link attacks responsible for many logic bugs • ES framework is based on MACF • ES extends MACF to user mode, very powerful • can be used to detect and block logic attacks • it's a pain to get the ES entitlement
- 41.
- 42. Further resources • WojciechReguła ( @_r3ggi ): Abusing and Securing XPC in macOS Apps Objective by the Sea v3 • Julia Vashchenko ( @iaronskaya ): Job(s) Bless Us! Privileged Operations on macOS Objective by the Sea v3 • Tyler Bohan ( @1blankwall1 ): OSX XPC Revisited - 3rd Party Application Flaws OffensiveCon 19 • Ian Beer ( @i41nbeer ): A deep-dive into the many fl avors of IPC available on OS X Jailbreak Security Summit 2015
- 43. Links • http://www.trustedbsd.org/mac.html • https://blog.xpnsec.com/macos-injection-via-third-party-frameworks/ •https://www.offensive-security.com/offsec/am fi -syscall/ • https://www.semanticscholar.org/paper/New-approaches-to-operating-system-security-Watson/ f89682c6cf943ce349031270e685ee2dddee9376 • https://knight.sc/reverse%20engineering/2019/08/24/system-extension-internals.html • http://newosxbook.com/articles/eps.html • https://github.com/xorrior/goesf/blob/master/appmon.m • https://github.com/theevilbit/Shield
- 44.