Download as PDF, PPTX
![$ file /bin/sync
/bin/sync: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64]
[i386:Mach-O executable i386]
/bin/sync (for architecture x86_64): Mach-O 64-bit executable x86_64
/bin/sync (for architecture i386): Mach-O executable i386](https://image.slidesharecdn.com/icanbeappleandsocanyou-180726072951/75/I-can-be-apple-and-so-can-you-20-2048.jpg)
![$ file /bin/sync
/bin/sync: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64]
[i386:Mach-O executable i386]
/bin/sync (for architecture x86_64): Mach-O 64-bit executable x86_64
/bin/sync (for architecture i386): Mach-O executable i386](https://image.slidesharecdn.com/icanbeappleandsocanyou-180726072951/75/I-can-be-apple-and-so-can-you-21-2048.jpg)
![$ file /bin/sync
/bin/sync: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64]
[i386:Mach-O executable i386]
/bin/sync (for architecture x86_64): Mach-O 64-bit executable x86_64
/bin/sync (for architecture i386): Mach-O executable i386](https://image.slidesharecdn.com/icanbeappleandsocanyou-180726072951/75/I-can-be-apple-and-so-can-you-22-2048.jpg)
Uploaded byShakacon
I can be apple and so can you
The document summarizes a presentation about exploiting a vulnerability in Apple's code signing process on macOS. The vulnerability allows ad-hoc signed malicious code to bypass Gatekeeper and execute on systems where only Apple-signed code is supposed to run. The presentation covered code signing basics, a demonstration of the vulnerability, technical details, how it impacts third-party software vendors, the disclosure process to Apple, and recommendations for properly validating signed code.
More Related Content
![[ENG] OHM2013 - The Quest for the Client-Side Elixir Against Zombie Browsers -](https://cdn.slidesharecdn.com/ss_thumbnails/ohmquest-130827053519-phpapp01-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to I can be apple and so can you
![[CONFidence 2016] Sławomir Kosowski - Introduction to iOS Application Securit...](https://cdn.slidesharecdn.com/ss_thumbnails/slawomirkosowski-introductiontoiospenetrationtesting-160603095607-thumbnail.jpg?width=640&height=640&fit=bounds)
![reductio [ad absurdum]](https://cdn.slidesharecdn.com/ss_thumbnails/taualywhssudecboubib-signature-40f4714a7511dbefb3f8b81978ee26a52b8bc17a56b46da771a1d673a5b4d7df-poli-170804175449-thumbnail.jpg?width=640&height=640&fit=bounds)
I can be apple and so can you
- 1. I Can BeApple, and So Can You Shakacon 2018 Josh Pitts @midnite_runr
- 2.
- 6.
- 7.
- 8.
- 9. Outline • Code signingBasics • DEMO • Vulnerability Details • What about Gatekeeper • Disclosure process • How to do signed code checks correctly • Process of finding this vulnerability • Q&A
- 10.
- 11.
- 12.
- 13. DEMO • Google Santa- in full lockdown mode; only Apple signed code can run (native code and macOS app store) • A malicious binary was delivered via phishing, social engineering, or post exploitation. • Persistence and hiding in plain-sight
- 14.
- 15.
- 16.
- 17. Conditions for thevulnerability • Takes advantage of the Fat/Universal binary format • The first Mach-O in the Fat/Universal file must be signed by Apple, can be i386, x86_64, or even PPC. • The malicious binary, or non-Apple supplied code, must be adhoc signed and i386 compiled for an x86_64 bit target macOS. • The CPU_TYPE in the Fat header of the Apple binary must be set to an invalid type or a CPU Type that is not native to the host chipset.
- 18. This vulnerability existsin the difference between how the Mach-O loader loads signed code vs how improperly used Code Signing APIs check signed code and is exploited via a malformed Universal/Fat Binary.
- 19. This vulnerability existsin the difference between how the Mach-O loader loads signed code vs how improperly used Code Signing APIs check signed code and is exploited via a malformed Universal/Fat Binary.
- 20. $ file /bin/sync /bin/sync:Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [i386:Mach-O executable i386] /bin/sync (for architecture x86_64): Mach-O 64-bit executable x86_64 /bin/sync (for architecture i386): Mach-O executable i386
- 21. $ file /bin/sync /bin/sync:Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [i386:Mach-O executable i386] /bin/sync (for architecture x86_64): Mach-O 64-bit executable x86_64 /bin/sync (for architecture i386): Mach-O executable i386
- 22. $ file /bin/sync /bin/sync:Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64] [i386:Mach-O executable i386] /bin/sync (for architecture x86_64): Mach-O 64-bit executable x86_64 /bin/sync (for architecture i386): Mach-O executable i386
- 23. This vulnerability existsin the difference between how the Mach-O loader loads code vs how improperly used Code Signing APIs check signed code and is exploited via a malformed Universal/Fat Binary.
- 24. $lipo -create python.x86_64ncat.i386 -output ncat.frankenstein
- 32. What vendors wereaffected?
- 33. Test Samples Sample NameNotes bash_not_signed Sample not signed, malformed header Bash_ppc_adhoc PPC, adhoc signed, non-malformed header Bash_adhoc Adhoc signed, malformed header Terminal.app Application Bundle, Adhoc signed, malformed header https://github.com/OktaSecurityLabs/CodeSigningSamples
- 34.
- 35.
- 36.
- 37.
- 38.
- 39.
- 40. Google - Santa,molcodesignchecker CVE-2018-10405
- 41. Google - Santa,molcodesignchecker CVE-2018-10405
- 42. Google - Santa,molcodesignchecker CVE-2018-10405
- 43. Google - Santa,molcodesignchecker CVE-2018-10405
- 44. Google - Santa,molcodesignchecker CVE-2018-10405
- 45.
- 46. Carbon Black -Cb Response CVE-2018-10407
- 47.
- 48.
- 49. Objective Development -LittleSnitch CVE-2018-10470
- 50. Objective Development -LittleSnitch CVE-2018-10470
- 51. Objective Development -LittleSnitch CVE-2018-10470
- 52.
- 53. How Apple SeesGatekeeper https://en.wikipedia.org/wiki/Gatekeeper_(macOS)#/media/File:Gatekeeper_logo.png
- 54. How I SeeGatekeeper http://www.dippylisty.com/contentdippyimages/2228.jpg
- 55. How I SeeGatekeeper http://www.dippylisty.com/contentdippyimages/2228.jpg
- 56.
- 57.
- 58. Protect • App Bundlesand DMGs via browser Bypass
- 59. Protect • App Bundlesand DMGs via browser • Standalone Mach-Os (no Bundles) <— My preference Bypass
- 60. Protect • App Bundlesand DMGs via browser • Zipped (.zip) App Bundles via browser (unless the user uses 7z to decompress 🤔) • Standalone Mach-Os (no Bundles) <— My preference Bypass
- 61. Protect • App Bundlesand DMGs via browser • Zipped (.zip) App Bundles via browser (unless the user uses 7z to decompress 🤔) • Standalone Mach-Os (no Bundles) <— My preference • 7z the App Bundle then via browser Bypass
- 62. Protect • App Bundlesand DMGs via browser • Zipped (.zip) App Bundles via browser (unless the user uses 7z to decompress 🤔) • Tar’ed App Bundles via browser (unless 7z is used again) • Standalone Mach-Os (no Bundles) <— My preference • 7z the App Bundle then via browser Bypass
- 63. Protect • App Bundlesand DMGs via browser • Zipped (.zip) App Bundles via browser (unless the user uses 7z to decompress 🤔) • Tar’ed App Bundles via browser (unless 7z is used again) • Standalone Mach-Os (no Bundles) <— My preference • 7z the App Bundle then via browser • If the user uses curl or wget on a zip/7z/tar’ed file Bypass
- 64. Protect • App Bundlesand DMGs via browser • Zipped (.zip) App Bundles via browser (unless the user uses 7z to decompress 🤔) • Tar’ed App Bundles via browser (unless 7z is used again) • Standalone Mach-Os (no Bundles) <— My preference • 7z the App Bundle then via browser • If the user uses curl or wget on a zip/7z/tar’ed file • App Bundle on a USB Bypass
- 65.
- 66.
- 67. Timeline • Feb 22,2018 - Sent an initial sample to apple where the ‘malicious’ code was not signed.
- 68. Timeline • Feb 22,2018 - Sent an initial sample to apple where the ‘malicious’ code was not signed. • March 1, 2018 - Product Security provides a recommendation to catch this.
- 69. Timeline • Feb 22,2018 - Sent an initial sample to apple where the ‘malicious’ code was not signed. • March 1, 2018 - Product Security provides a recommendation to catch this. • March 6, 2018 - I provide a sample that bypasses their recommendations.
- 70. Timeline • Feb 22,2018 - Sent an initial sample to apple where the ‘malicious’ code was not signed. • March 1, 2018 - Product Security provides a recommendation to catch this. • March 6, 2018 - I provide a sample that bypasses their recommendations. • March 20, 2018 - Product Security provides another recommendation that doesn’t solve the issue.
- 71. Timeline • Feb 22,2018 - Sent an initial sample to apple where the ‘malicious’ code was not signed. • March 1, 2018 - Product Security provides a recommendation to catch this. • March 6, 2018 - I provide a sample that bypasses their recommendations. • March 20, 2018 - Product Security provides another recommendation that doesn’t solve the issue. • March 21, 2018 - I respond with a workflow how to solve the issue with a hope they will address the issue.
- 72. Timeline • Feb 22,2018 - Sent an initial sample to apple where the ‘malicious’ code was not signed. • March 1, 2018 - Product Security provides a recommendation to catch this. • March 6, 2018 - I provide a sample that bypasses their recommendations. • March 20, 2018 - Product Security provides another recommendation that doesn’t solve the issue. • March 21, 2018 - I respond with a workflow how to solve the issue with a hope they will address the issue. • March 29, 2018 - Product Security states that third party developers will have to address the issue and documentation will be updated.
- 73.
- 76.
- 77.
- 78. “God help anyoneusing these APIs”
- 81. Timeline • April 9,2018 - Known affected third party developers contacted • April 18, 2018 - CERT/CC recommends a blog post for full exposure • June 12, 2018 - Public disclosure https://www.okta.com/security-blog/ 2018/06/issues-around-third-party-apple-code-signing-checks/
- 82. June 9, 2018 SecStaticCodeCheckValidityAPI Documentation https://webcache.googleusercontent.com/search?q=cache:1mpf6FhZY6YJ:https://developer.apple.com/documentation/security/1395784-secstaticcodecheckvalidity+&cd=1&hl=en&ct=clnk&gl=us
- 83. Sometime after June12th SecStaticCodeCheckValidity API Documentation https://webcache.googleusercontent.com/search?q=cache:QWANld5WHeAJ:https://developer.apple.com
- 84. Sometime after June12th SecStaticCodeCheckValidity API Documentation https://webcache.googleusercontent.com/search?q=cache:QWANld5WHeAJ:https://developer.apple.com
- 85. How do wedo signed code checks on macOS correctly?
- 86.
- 88. • $ codesign-vv -R=“anchor apple” ./some.app or <pid>
- 89. • $ codesign-vv -R=“anchor apple” ./some.app or <pid> • $ codesign -vv -R=“anchor apple generic” ./some.app or <pid>
- 90. • $ codesign-vv -R=“anchor apple” ./some.app or <pid> • $ codesign -vv -R=“anchor apple generic” ./some.app or <pid> • $ lipo -thin x86_64 login -output login.x64 # <— then check this…
- 91.
- 92. It Depends • Usethe SecRequirementCreateWithString and pass “anchor apple” or “anchor apple generic” • Use SecStaticCodeCheckValidity with kSecCSDefaultFlags | kSecCSCheckNestedCode | kSecCSCheckAllArchitectures | kSecCSEnforceRevocationChecks flags • Then you could still need to break out each slice in the FAT file to ensure they are the same signer! https://github.com/objective-see/WhatsYourSign/blob/29aec698696d58cb1d1d6f0cc9dbeb0340d6bd78/WhatsYourSignExt/FinderSync/Signing.m#L324 https://github.com/objective-see/WhatsYourSign/blob/29aec698696d58cb1d1d6f0cc9dbeb0340d6bd78/WhatsYourSignExt/FinderSync/Signing.m#L334
- 93.
- 94.
- 95. ShmooCon 2016 “Hiding fromthe Investigator”
- 96. Remember the FatFile?
- 98.
- 102.
- 103. Remember Lipo? $lipo -createi386 i386 -output frankenstein
- 104.
- 105. FAIL $ lipo -createbash.x64 python.x64 -output ./bash_python fatal error:/usr/bin/lipo: bash.x64 and python.x64 have the same architectures (x86_64) and can't be in the same fat output file
- 106. FAIL $ lipo -createbash.x64 python.x64 -output ./bash_python fatal error:/usr/bin/lipo: bash.x64 and python.x64 have the same architectures (x86_64) and can't be in the same fat output file $ ./bash_python bash: ./bash_python: Malformed Mach-o file
- 107.
- 108.
- 109.
- 110.