{"id":29712,"date":"2020-08-07T16:34:44","date_gmt":"2020-08-07T20:34:44","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=29712"},"modified":"2021-07-06T16:47:56","modified_gmt":"2021-07-06T20:47:56","slug":"infecting-macos-via-macro-laden-documents","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2020\/08\/07\/infecting-macos-via-macro-laden-documents\/","title":{"rendered":"Infecting macOS via Macro-laden Documents"},"content":{"rendered":"<p><a href=\"https:\/\/objective-see.com\/blog\/blog_0x4B.html\">Patrick Wardle<\/a> (also: <a href=\"https:\/\/www.vice.com\/en_us\/article\/jgxamy\/hacker-finds-a-way-to-hack-mac-users-via-microsoft-office\">Lorenzo Franceschi-Bicchierai<\/a>):<\/p>\n<blockquote cite=\"https:\/\/objective-see.com\/blog\/blog_0x4B.html\">\n<p>Here, we&rsquo;ll detail the creation of a powerful exploit chain that began with CVE-2019-1457, leveraged a new sandbox escape and ended with a full bypass of Apple&rsquo;s stringent notarization requirements. Triggered by simply opening a malicious (macro-laced) Office document, no alerts, prompts, nor other user interactions were required in order to persistently infect even a fully-patched macOS Catalina system!<\/p>\n<p>[&#8230;]<\/p>\n<p>Though one could not longer create a launch agent (due to Microsoft&rsquo;s patch), I discovered that macOS had no problem allowing malicious code running in the sandbox from creating a login item! Similar to launch agents, login items are automatically launched by macOS each time the user logs in &#8230;and run outside the sandbox[&#8230;]<\/p>\n<\/blockquote>\n\n<p>See also: <a href=\"https:\/\/taomm.org\">The Art Of Mac Malware<\/a> (<a href=\"https:\/\/twitter.com\/patrickwardle\/status\/1291157891567816704\">tweet<\/a>).<\/p>\n\n<p>Previously:<\/p>\n<ul>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2020\/04\/28\/mac-sandbox-escape-via-textedit\/\">Mac Sandbox Escape via TextEdit<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2018\/08\/02\/escaping-the-sandbox-microsoft-office\/\">Escaping the Sandbox &#x2013; Microsoft Office<\/a><\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"<p>Patrick Wardle (also: Lorenzo Franceschi-Bicchierai): Here, we&rsquo;ll detail the creation of a powerful exploit chain that began with CVE-2019-1457, leveraged a new sandbox escape and ended with a full bypass of Apple&rsquo;s stringent notarization requirements. Triggered by simply opening a malicious (macro-laced) Office document, no alerts, prompts, nor other user interactions were required in order [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"apple_news_api_created_at":"2020-08-07T20:34:48Z","apple_news_api_id":"325102f2-0356-464e-95f9-4da88b38f52e","apple_news_api_modified_at":"2021-07-06T20:48:00Z","apple_news_api_revision":"AAAAAAAAAAAAAAAAAAAAAQ==","apple_news_api_share_url":"https:\/\/apple.news\/AMlEC8gNWRk6V-U2oizj1Lg","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":"\"\"","apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"footnotes":""},"categories":[2],"tags":[131,2095,30,1666,577,1842,53,48],"class_list":["post-29712","post","type-post","status-publish","format-standard","hentry","category-technology","tag-bug","tag-exploit","tag-mac","tag-macos-10-15","tag-microsoft-office","tag-notarization","tag-sandboxing","tag-security"],"apple_news_notices":[],"_links":{"self":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/29712","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/comments?post=29712"}],"version-history":[{"count":2,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/29712\/revisions"}],"predecessor-version":[{"id":29716,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/29712\/revisions\/29716"}],"wp:attachment":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/media?parent=29712"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/categories?post=29712"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/tags?post=29712"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}