{"id":45455,"date":"2024-10-21T14:06:07","date_gmt":"2024-10-21T18:06:07","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=45455"},"modified":"2024-10-21T14:06:07","modified_gmt":"2024-10-21T18:06:07","slug":"tcc-and-gatekeeper-bypasses","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2024\/10\/21\/tcc-and-gatekeeper-bypasses\/","title":{"rendered":"TCC and Gatekeeper Bypasses"},"content":{"rendered":"

Wojciech Reguła<\/a> (September 2021, tweet<\/a>):<\/p>\n

\n

I was looking for code injection opportunities that may allow reaching TCC bypasses. My simple shell script discovered a potential victim - \/System\/Library\/CoreServices\/Applications\/Directory Utility.app<\/code>. It had (and has) the following private TCC entitlement[…] This entitlement allows the Directory Utility to modify the user’s records stored in the \/var\/db\/dslocal\/nodes<\/code> directory.<\/p>\n

[…]<\/p>\n

After some time I stumbled across the above-mentioned Matt Shockley’s article on how he was able to bypass TCC only by changing the $HOME<\/code> directory via launchctl<\/code>. I was really curious about how Apple fixed that vulnerability so I started reversing the TCC. Turns out that now TCC takes the information about the user’s home directory from the getpwuid<\/code> function.<\/p>\n

[…]<\/p>\n

I was really shocked that Apple decided that this vulnerability is not eligible for the bounty. [They later changed their mind.]<\/p>\n<\/blockquote>\n\n

Wojciech Reguła<\/a> (March 2022):<\/p>\n

This post shows how to bypass the macOS privacy framework (TCC) using old app versions.<\/p>

[…]<\/p>

Summing it up - there is no version information. It is exactly the same architectonical problem as the macOS Keychain has. In most cases it is possible to get an older version of the “donor” application (without the hardened runtime flag), inject to it, and thus abuse its TCC permissions.<\/p><\/blockquote>\n\n

Phil Stokes<\/a> (March 2023):<\/p>\n

The scourge of ransomware attacks that has plagued Windows endpoints over the past half decade or so has, thankfully, not been replicated on Mac devices. With a few unsuccessful exceptions, the notion of locking a Mac device and holding its owner to ransom in return for access to the machine and its data has not yet proven an attractive proposition for attackers.<\/p>

However, the idea of stealing valuable data and then monetizing it<\/a> in nefarious ways is a tactic that is now common across platforms. On macOS, threat actors will quietly exfiltrate session cookies, keychains, SSH keys and more as malicious processes from adware to spyware<\/a> look to harvest data that can be recycled and sold on various underground forums<\/a> and marketplaces, or used directly in espionage campaigns and supply chain attacks<\/a>.<\/p>

[…]<\/p>

Session cookies can be stored anywhere, but typically they are in locations which can be accessed by the user or a process running as the user. Some locations, such as the User’s Library Cookies folder, may be restricted by TCC<\/a> unless the parent process has Full Disk Access<\/a> or uses one of the many known TCC bypasses<\/a>. Real world attacks (e.g., XCSSET<\/a>) and researchers<\/a> have consistently<\/a> shown that TCC, while often a nuisance to users, does not present a significant obstacle to attackers.<\/p><\/blockquote>\n\n

Mickey Jin<\/a> (January 2024):<\/p>\n

Last year, I discovered a full user TCC bypass issue in the macOS Sonoma beta version. There was a CVE number assigned at the beginning, but removed by Apple in the release of macOS 14.0. Instead, I got the credit in their Additional Recognitions<\/a>.<\/p>

According to the Apple Security Bounty program, this report should have been rewarded with an additional 50%. Unfortunately, the truth is that I was cut off 50%.<\/p><\/blockquote>\n\n

Wojciech Reguła<\/a>:<\/p>\n

This vulnerability was disclosed at Black Hat Europe 2022 in the talk Knockout Win Against TCC - 20+ NEW Ways to Bypass Your MacOS Privacy Mechanisms<\/a>. The technique used an old Launch Services function LSSetDefaultRoleHandlerForContentType<\/a> that allowed (without any restrictions) to register arbitrary applications for handling specified UTI handlers. After the UTI handling app registration, the exploit simply opens juicy files (like AddressBook or iMessages database) and TCC happily grants access to them. At that time TCC couldn’t recognize correctly if a file was opened by launch services or double-clicked by a user.<\/p><\/blockquote>\n\n

Wojciech Reguła<\/a>:<\/p>\n

\n

The technique relied on an SQLite environment variable respected by libsqlite3.dylib<\/code> which made apps using the standard SQLite system API log all the SQL queries. As such queries may contain sensitive user data normally protected by the TCC - I started researching all the problematic occurrences.<\/p>\n<\/blockquote>\n\n

Unit 42<\/a>:<\/p>\n

Apple states<\/a> that user-installed unarchiving tools preserve quarantine. As we can see in the following examples, there are some third-party archive tools that do not enforce that, which means that Gatekeeper won’t scan the extracted files.<\/p>

[…]<\/p>

In VMware Fusion, when copying a file from a host machine to a guest macOS virtual machine (VM) using VMware tools, the quarantine extended attribute will be dropped from the copied file as shown in Figure 4. This means Gatekeeper won’t scan any files copied into the virtual machine.<\/p><\/blockquote>\n\n

Microsoft Threat Intelligence<\/a>:<\/p>\n

The vulnerability, which we refer to as “HM Surf”, involves removing the TCC protection for the Safari browser directory and modifying a configuration file in the said directory to gain access to the user’s data, including browsed pages, the device’s camera, microphone, and location, without the user’s consent.<\/p>

[…]<\/p>

Our exploit involves the following steps:<\/p>

  1. Change the home directory of the current user with the dscl<\/a> utility, which does not require TCC access in Sonoma (At this point, the ~\/Library\/Safari<\/em> directory is no longer TCC protected).<\/li>
  2. Modify the sensitive files under the user’s real home directory (such as \/Users\/$USER\/Library\/Safari\/PerSitePreferences.db<\/em>).<\/li>
  3. Change the home directory again so Safari uses the now modified files.<\/li>
  4. Run Safari to open a webpage that takes a camera snapshot and trace device location.<\/li><\/ol><\/blockquote>\n\n

    Osama Alhour<\/a> (PDF, tweet<\/a>):<\/p>\n

    This paper seeks to provide a comprehensive technical analysis of how TCC works internally, how it interacts with other system components, and it’s impact on both how developers shape their applications as well as user control granting sensitive data to applications.<\/p><\/blockquote>\n\n

    Previously:<\/p>\n