{"id":34529,"date":"2021-12-23T16:33:55","date_gmt":"2021-12-23T21:33:55","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=34529"},"modified":"2023-12-06T14:23:04","modified_gmt":"2023-12-06T19:23:04","slug":"bypass-tcc-via-privileged-helpers","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2021\/12\/23\/bypass-tcc-via-privileged-helpers\/","title":{"rendered":"Bypass TCC via Privileged Helpers"},"content":{"rendered":"<p><a href=\"https:\/\/wojciechregula.blog\/post\/bypass-tcc-via-privileged-helpers-aka-cve-2020-10008\/\">Wojciech Regu&#x142;a<\/a>:<\/p>\n<blockquote cite=\"https:\/\/wojciechregula.blog\/post\/bypass-tcc-via-privileged-helpers-aka-cve-2020-10008\/\">\n<p>This vulnerability has been disclosed on <a href=\"https:\/\/athack.com\/\">@Hack<\/a> in Saudi Arabia in <a href=\"https:\/\/www.slideshare.net\/wojdwo\/20-ways-to-bypass-your-macos-privacy-mechanisms-250791887\">20+ Ways To Bypass Your Macos Privacy Mechanisms<\/a> presentation. In the end, it allowed impersonating TCC entitlements of any application installed on the device.<\/p>\n<p>[&#8230;]<\/p>\n<p>Applications may install privileged helpers in the <code>\/Library\/PrivilegedHelpers<\/code> directory. When such a helper tries to access the protected resource (e.g. Address Book), TCC tries to determine which app is responsible for the helper. If the main app is determined, TCC checks whether the app has proper permissions and grants the helper access to the protected resources. The problem is that a malicious helper may trick TCC to select the wrong application as the main app and thus use its entitlements.<\/p>\n<p>[&#8230;]<\/p>\n<p>It&rsquo;s important to understand that the <em>SMJobBless<\/em> API is not required to register a privileged helper. A malicious application can just create a plist in the <code>\/Library\/LaunchDaemons<\/code> directory, place the helper in the <code>\/Library\/PrivilegedHelpers<\/code>, load&amp;start the helper via launchctl. So, there is no guarantee that the <em>SMAuthorizedClients<\/em> key will be pointing to the right owner.<\/p>\n<\/blockquote>\n\n<p>Previously:<\/p>\n<ul>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2021\/07\/13\/overview-of-tcc-bypasses-by-accident-and-design\/\">Overview of TCC Bypasses by Accident and Design<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2019\/09\/02\/privilegedhelpertools-and-checking-xpc-peers\/\">PrivilegedHelperTools and Checking XPC Peers<\/a><\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"<p>Wojciech Regu&#x142;a: This vulnerability has been disclosed on @Hack in Saudi Arabia in 20+ Ways To Bypass Your Macos Privacy Mechanisms presentation. In the end, it allowed impersonating TCC entitlements of any application installed on the device. [&#8230;] Applications may install privileged helpers in the \/Library\/PrivilegedHelpers directory. When such a helper tries to access the [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"apple_news_api_created_at":"2021-12-23T21:33:58Z","apple_news_api_id":"37c40054-4061-4190-b072-4352b2aca73b","apple_news_api_modified_at":"2023-12-06T19:23:07Z","apple_news_api_revision":"AAAAAAAAAAAAAAAAAAAAAQ==","apple_news_api_share_url":"https:\/\/apple.news\/AN8QAVEBhQZCwckNSsqynOw","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":"\"\"","apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"footnotes":""},"categories":[4],"tags":[2098,131,2518,2095,30,2077,71,48,1960],"class_list":["post-34529","post","type-post","status-publish","format-standard","hentry","category-programming-category","tag-apple-security-bounty","tag-bug","tag-entitlements","tag-exploit","tag-mac","tag-macos-12","tag-programming","tag-security","tag-transparency-consent-and-control-tcc"],"apple_news_notices":[],"_links":{"self":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/34529","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/comments?post=34529"}],"version-history":[{"count":1,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/34529\/revisions"}],"predecessor-version":[{"id":34530,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/34529\/revisions\/34530"}],"wp:attachment":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/media?parent=34529"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/categories?post=34529"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/tags?post=34529"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}