1
00:01:35,180 --> 00:01:38,820
Make sure it's not just me who's seeing it weird.

2
00:01:44,560 --> 00:01:47,100
So now they should see the three of us.

3
00:01:52,330 --> 00:01:54,290
Oh yeah, I see us.

4
00:01:54,650 --> 00:01:55,770
You see us?

5
00:01:55,910 --> 00:01:57,670
Yeah, I just went to the Twitch stream.

6
00:01:57,670 --> 00:01:58,310
Oh, excellent.

7
00:01:58,310 --> 00:01:59,510
Which Twitch stream?

8
00:02:02,190 --> 00:02:04,730
I hear myself now, too.

9
00:02:05,410 --> 00:02:06,650
Okay, that's fantastic.

10
00:02:06,730 --> 00:02:10,050
We are a professional organization here on a Friday night.

11
00:02:11,190 --> 00:02:13,690
Yeah, we're going to call that one my fault.

12
00:02:13,690 --> 00:02:14,950
Okay, cool.

13
00:02:16,310 --> 00:02:19,450
Welcome to Q&A with Patrick Wardle.

14
00:02:19,450 --> 00:02:26,330
We are going to be talking about some macOS stuff and some stuff kind of adjacent to Microsoft Office.

15
00:02:27,470 --> 00:02:31,970
I am Jurist, and the other goon that you see here is Fallible.

16
00:02:32,110 --> 00:02:35,770
And we're going to be helping ask Patrick some questions this evening.

17
00:02:35,770 --> 00:02:38,470
And it's good to see you all in the chat.

18
00:02:38,470 --> 00:02:43,290
Patrick, why don't you take a minute to introduce yourself to everybody?

19
00:02:43,290 --> 00:02:47,890
Because I know that in your talk, you kind of dove right in into your content.

20
00:02:47,890 --> 00:02:51,590
So take a minute, say hello to everybody, tell us a little bit about yourself.

21
00:02:52,210 --> 00:02:52,890
Sure.

22
00:02:52,890 --> 00:02:55,130
Aloha, my name is Patrick Wardle.

23
00:02:55,130 --> 00:02:58,630
I am a principal security researcher at Jamf.

24
00:02:58,630 --> 00:03:05,110
I'm also the creator of the Mac security website and tool suite, Objective-C.

25
00:03:05,110 --> 00:03:09,430
I have been fortunate enough to talk at a few DEF CONs in the past.

26
00:03:09,430 --> 00:03:13,610
It's always one of my favorite events to talk nerdy at.

27
00:03:13,970 --> 00:03:18,750
This year, virtual, you know, a little bummed we didn't all get to hang out together in Vegas.

28
00:03:18,750 --> 00:03:21,830
But I think it's important that we're all staying safe and healthy.

29
00:03:21,890 --> 00:03:26,010
And actually connecting online is kind of super hacker-ish.

30
00:03:26,010 --> 00:03:31,250
So I'm stoked you're all here to chat a little bit more about my talk, open Q&A.

31
00:03:31,390 --> 00:03:32,750
Again, welcome.

32
00:03:33,590 --> 00:03:35,530
Well, thank you for being here.

33
00:03:35,530 --> 00:03:36,890
We really appreciate it.

34
00:03:36,890 --> 00:03:41,610
It's nice to get some folks who want to come present this way.

35
00:03:41,750 --> 00:03:47,110
So Sneakernet gave us what they're considering to be a softball question.

36
00:03:47,110 --> 00:03:51,270
Is SYLK the old file format you've come across?

37
00:03:51,270 --> 00:03:57,810
Is there a way to programmatically scan macOS apps for what kind of files they handle?

38
00:03:57,810 --> 00:03:58,770
Entitlements?

39
00:03:58,770 --> 00:04:00,810
Particular API usage?

40
00:04:01,890 --> 00:04:03,870
Yeah, so that's a great question.

41
00:04:03,870 --> 00:04:09,650
The first place I would look at is in something called the Launch Services Database.

42
00:04:09,650 --> 00:04:14,130
And you can enumerate this with the ls register command.

43
00:04:14,130 --> 00:04:23,130
And what it will basically do is it will dump all the file type and application associations on your macOS system.

44
00:04:23,130 --> 00:04:27,690
So for example, you can see what applications have registered for HTML files.

45
00:04:27,690 --> 00:04:31,170
What applications have registered to handle documents.

46
00:04:31,190 --> 00:04:36,730
In this case, what type of applications perhaps support these SYLK files.

47
00:04:36,730 --> 00:04:38,330
So that's kind of where I would start.

48
00:04:38,330 --> 00:04:41,050
It gives you a global overview of that.

49
00:04:41,250 --> 00:04:44,910
So if you just Google ls register, again, it's a macOS command.

50
00:04:44,910 --> 00:04:48,310
You run it with the dash dump flag and it will dump this database.

51
00:04:48,490 --> 00:04:54,430
You can also look at an application's info.plist file, which is something that all applications have.

52
00:04:54,430 --> 00:05:06,750
And in there, they can have a set, it's actually an array, a dictionary of key value pairs that kind of tell the operating system what type of applications, sorry, what kind of files they support.

53
00:05:06,750 --> 00:05:10,170
And this is actually how that database gets populated.

54
00:05:10,290 --> 00:05:15,970
So for example, Microsoft Office lists the doc files and file formats it supports.

55
00:05:15,970 --> 00:05:21,250
Obviously a browser will have a large list including HTML files, probably PDFs, etc.

56
00:05:21,250 --> 00:05:26,010
That's a great place to start because then you can see the file formats.

57
00:05:26,010 --> 00:05:31,110
And then I would look at the more esoteric or unrecognized ones and start fuzzing or playing with that.

58
00:05:31,110 --> 00:05:46,690
Because it's kind of mentioned in my talk, the reason that this vulnerability existed, specifically the automatic execution of macros, was that Microsoft actually has two separate code paths for handling macros based on these file types.

59
00:05:46,690 --> 00:05:55,530
Obviously the main one for documents, and then a whole separate archaic code path that probably no one ever looked at for these older file formats.

60
00:05:55,530 --> 00:06:01,950
Always a good idea to look for these more esoteric, ancient file formats because there's a lot of security bugs there.

61
00:06:01,950 --> 00:06:06,490
Because they were created in a time when security wasn't really a priority.

62
00:06:07,450 --> 00:06:14,710
Any time an afterthought gets pulled forward into what's happening now is probably an interesting space.

63
00:06:14,710 --> 00:06:15,750
Exactly.

64
00:06:17,930 --> 00:06:18,650
Cool.

65
00:06:18,650 --> 00:06:21,870
Next question coming in also from Sneakernet.

66
00:06:21,930 --> 00:06:24,770
Is there a way to programmatically scan Mac apps?

67
00:06:24,770 --> 00:06:26,350
Oh, we did that one already.

68
00:06:27,230 --> 00:06:28,270
Let's see here.

69
00:06:28,270 --> 00:06:39,070
Have you considered trying to do something similar to this kind of research with iPad OS or any other kind of non-Windows OS or mobile OS?

70
00:06:40,070 --> 00:06:41,430
That's a great question.

71
00:06:41,430 --> 00:06:44,450
I predominantly focus on Mac for two reasons.

72
00:06:44,450 --> 00:06:50,330
First, my personal opinion is it's really good to get really niche in whatever area that interests.

73
00:06:50,330 --> 00:06:56,550
That's just something that I've found to kind of have a lot of success in my InfoSec security career.

74
00:06:56,850 --> 00:07:05,950
The other fact, and yes, I will admit this, is hacking Mac is far simpler than hacking an iOS operating system or iPad OS.

75
00:07:06,070 --> 00:07:10,010
Largely, this is just because of how locked down that operating system is.

76
00:07:10,010 --> 00:07:22,510
So I think there has been some research done in the past based on custom URL handling, which is largely how applications and certain file formats are kind of connected in a way on iOS.

77
00:07:22,790 --> 00:07:35,490
But even if you found some interesting issues there, you would have to break out of the sandbox and then deal with a lot of the extra constraints that iOS and iPad OS kind of stack on top.

78
00:07:35,490 --> 00:07:39,030
That with Mac OS, you really don't have to worry about compulsion.

79
00:07:39,030 --> 00:07:44,250
We did have to find a new sandbox escape, but we showed that was pretty trivial to do.

80
00:07:44,250 --> 00:07:46,030
And there's been kind of history of that.

81
00:07:46,170 --> 00:07:51,130
So, you know, the TLDR, iOS is just really a hard target.

82
00:07:51,510 --> 00:07:54,470
So I'll probably just stick with Macs for now.

83
00:07:54,730 --> 00:08:04,310
So that's an interesting statement, though, that you found that getting really niche is the thing that helps you continue to find new interesting vulnerabilities.

84
00:08:04,310 --> 00:08:07,730
So you're keeping your target list really small.

85
00:08:07,730 --> 00:08:10,130
Can you talk about that any more?

86
00:08:10,130 --> 00:08:15,250
And what are some of the strengths that that's bringing you?

87
00:08:15,250 --> 00:08:21,130
And can you think of anything that you're missing that maybe if there was one more thing you wanted to add?

88
00:08:22,190 --> 00:08:22,770
Yeah, I know.

89
00:08:22,770 --> 00:08:27,770
And that's something that, you know, as I grow older and wiser, it's something that resonates really well with me.

90
00:08:27,770 --> 00:08:34,750
So , you know, a long time ago, I used to work at the NSA, National Security Agency, everyone's favorite U.S.

91
00:08:34,750 --> 00:08:36,310
government spy agency.

92
00:08:36,310 --> 00:08:38,850
And I remember when I got there, I was an intern.

93
00:08:39,130 --> 00:08:45,970
And the intern program, you kind of bounce around from different offices, kind of sampling different activities, let's say.

94
00:08:46,010 --> 00:08:55,950
And I remember thinking, I want to be good at all of this, like crypto and like mercenary malware, writing Windows exploits and hacking satellites, like all the really cool stuff the NSA does.

95
00:08:56,430 --> 00:09:02,290
And I got to a point where I was like, you know, it's just impossible to have depth in so much breadth.

96
00:09:02,570 --> 00:09:05,750
So I said, look, I'm going to kind of focus on one specific thing.

97
00:09:06,350 --> 00:09:11,430
And actually, it was only when I left the NSA was when I really started focusing on Macs.

98
00:09:11,650 --> 00:09:17,910
The reason for that was, at the NSA, I did predominantly Windows stuff.

99
00:09:18,290 --> 00:09:25,130
And so when I left, I wanted to still use my foundational skills of reverse engineering, vulnerability discovery, exploit development.

100
00:09:25,130 --> 00:09:27,270
But I didn't want to do it on the same platform.

101
00:09:27,270 --> 00:09:31,550
I was kind of poking around with the NSA, just it's good not to cross any lines.

102
00:09:31,550 --> 00:09:33,470
And, you know, you don't want to piss off the NSA.

103
00:09:33,470 --> 00:09:35,470
I said, hey, look, let me focus on Mac.

104
00:09:35,690 --> 00:09:40,670
I can use my same skill sets, but it's a separate platform, so I probably won't step on any of those.

105
00:09:42,030 --> 00:09:45,630
And moving forward with that, I really kind of doubled down on that.

106
00:09:45,630 --> 00:09:49,490
And it really allowed me to get a lot of depth in the topic.

107
00:09:49,490 --> 00:10:01,310
And I've noticed for, you know, finding new vulnerabilities, giving conference talks, right, at least for me, having that depth has really allowed me to become somewhat of an expert in the space, I would say.

108
00:10:01,310 --> 00:10:09,990
And allowed me to really dig more into maybe the more esoteric parts of the operating system where a lot of vulnerabilities lie.

109
00:10:09,990 --> 00:10:18,110
Whereas if I was trying to do that across maybe multiple operating systems and multiple platforms, it's just, I think, impossible to gain that much depth.

110
00:10:18,110 --> 00:10:20,630
So that's something that's just really worked for me.

111
00:10:20,630 --> 00:10:30,030
I would say the one downside is sometimes you might miss attacks that work on one platform that might have a conceptually similar vulnerability on that class.

112
00:10:30,030 --> 00:10:34,150
One great example I can think of is DLL or dynamic hijacking.

113
00:10:34,150 --> 00:10:37,610
This is a very common kind of attack scenario on Windows.

114
00:10:37,890 --> 00:10:49,190
And I, you know, when I was still kind of coming into the Mac space, I decided to see if macOS was vulnerable, at least conceptually, to the idea of hijacking dynamic libraries based on search path.

115
00:10:49,190 --> 00:10:54,710
And it turned out it was, and I just happened to be the first person that kind of dug into that and talked about it.

116
00:10:54,710 --> 00:11:00,630
So I still think it's good to keep your eyes and ears open and see what other research other people are doing.

117
00:11:01,290 --> 00:11:05,870
Just to be inspired and then kind of say, hey, is this something I can bring into my platform?

118
00:11:06,350 --> 00:11:13,990
But again, I've had a lot of success really focusing just on one platform, you know, macOS, not even iOS as much.

119
00:11:14,030 --> 00:11:18,350
So again, to me, that's worked really well, and I think it's a good nugget of advice.

120
00:11:18,350 --> 00:11:31,930
Yeah, thank you for talking about that a bit, because it's nice to hear somebody who's gotten a lot of success with a pattern like that, because there's many different patterns that I've been hearing about even this weekend.

121
00:11:31,930 --> 00:11:35,030
So it's nice to get that reinforcement.

122
00:11:35,230 --> 00:11:38,510
Yeah, I would agree with that, because I do a lot of digital forensics, right?

123
00:11:38,590 --> 00:11:50,310
And, you know, so I see a lot of Windows stuff come across, and I see a lot of iOS stuff, and it's kind of difficult to know, hey, you know, if I'm going to dedicate some time to build up some skills, you know, should it be broad-based, should it be targeted?

124
00:11:50,310 --> 00:11:54,050
And again, I'm digging what you're throwing down there.

125
00:11:55,530 --> 00:11:56,410
Next question.

126
00:11:56,410 --> 00:12:06,270
Okay, so you showed how putting a zip file into the login items, that in turn contains a plist with a launch agent, right?

127
00:12:06,270 --> 00:12:11,470
So does macOS really register launch agents on the creation of the file?

128
00:12:11,470 --> 00:12:14,910
In this case, creating it via an on-zip.

129
00:12:17,110 --> 00:12:17,790
Almost.

130
00:12:17,790 --> 00:12:22,110
So actually what it does is it automatically processes it on the next login.

131
00:12:22,110 --> 00:12:33,630
So it doesn't trigger it right away on creation, but on the next login, macOS will automatically just enumerate all the property lists that are created in the launch agent directory.

132
00:12:33,630 --> 00:12:35,290
It does the same thing with launch statements.

133
00:12:35,290 --> 00:12:38,570
And any property list it finds, it just runs it.

134
00:12:38,570 --> 00:12:47,550
So that's really kind of a neat thing that we were able to leverage as a mechanism to get this kind of code execution outside the sandbox.

135
00:12:47,550 --> 00:12:53,470
The only downside is you then have to kind of wait until the user re-logs in.

136
00:12:53,470 --> 00:12:59,970
But, you know, I like to say, you know, humans are impatient, but our exploits, our malware, you know, don't have to be, right?

137
00:12:59,970 --> 00:13:10,050
If we drop this launch agent and we have to wait two or three days, or even a week, until the user re-logs in, and then we get a callback, like, so be it, right?

138
00:13:10,050 --> 00:13:12,770
Generally we're not in that much of a rush.

139
00:13:12,770 --> 00:13:20,610
But it is interesting that macOS kind of automatically runs those, and something that we can, in this scenario, leverage to our own benefit.

140
00:13:22,210 --> 00:13:23,050
Sure.

141
00:13:23,050 --> 00:13:25,110
Follow-up from the same person that asked the question.

142
00:13:25,110 --> 00:13:28,450
Any plist it can find on the file system?

143
00:13:29,870 --> 00:13:41,450
No, it actually has to be in the launch agent directory, which is either in tilde user slash library launch agent or slash library slash launch agents.

144
00:13:41,450 --> 00:13:44,690
So macOS will look in those specific directories.

145
00:13:44,690 --> 00:13:48,150
It looks for other items in other directories.

146
00:13:48,150 --> 00:13:53,890
For example, there are other launch daemon directories, which it looks for other property lists.

147
00:13:53,890 --> 00:13:57,830
But again, those have to be in those specific directories.

148
00:13:58,450 --> 00:13:59,330
Cool.

149
00:13:59,590 --> 00:14:04,350
So, you know, a lot of this starts by you talking about macro attacks.

150
00:14:04,350 --> 00:14:08,010
And macro attacks have been popular on Windows for a long time.

151
00:14:08,010 --> 00:14:17,350
In fact, using macros inside of Office documents, I mean, you and I are roughly the same age, that's how you would get out of, like, the net nanny kind of stuff?

152
00:14:17,350 --> 00:14:25,390
Or you get around the stuff that they put on stuff at high school or middle school so you couldn't get on the internet, right?

153
00:14:25,390 --> 00:14:25,750
You know?

154
00:14:25,750 --> 00:14:26,370
Yeah.

155
00:14:26,370 --> 00:14:27,610
Sensual limitations is good?

156
00:14:27,610 --> 00:14:29,150
Well, it's fine now.

157
00:14:30,290 --> 00:14:35,470
So it is bananas to me that this stuff kind of persists now.

158
00:14:35,830 --> 00:14:42,330
Do you think that this is kind of a trend towards macro-based attacks towards macOS?

159
00:14:42,330 --> 00:14:51,270
Or is this just kind of a situation where, you know, the guys are, you know, if you've got a hammer in your hand, everything looks like a nail kind of a situation?

160
00:14:52,410 --> 00:14:57,710
Yeah, no, it's interesting because I think, well, we see two things happening.

161
00:14:57,710 --> 00:14:59,490
Maps are definitely becoming more prevalent.

162
00:14:59,810 --> 00:15:05,130
You know, we've seen this, especially in the consumer space, but now also in the enterprise space.

163
00:15:05,130 --> 00:15:08,110
And I think that's one of the reasons this is very anecdotal.

164
00:15:08,110 --> 00:15:10,270
I don't have necessarily data to back this up.

165
00:15:10,270 --> 00:15:15,730
But, you know, you go to a college campus even three or four or five years ago, everyone has Macs, right?

166
00:15:15,890 --> 00:15:20,290
And now those students have graduated or entered the workforce.

167
00:15:20,370 --> 00:15:20,970
What do they want?

168
00:15:20,970 --> 00:15:22,110
They want Mac computers.

169
00:15:22,370 --> 00:15:23,490
Understandably so, right?

170
00:15:23,570 --> 00:15:28,110
So we're kind of starting to see growth in the enterprise of Macs as well.

171
00:15:28,110 --> 00:15:32,510
Apple obviously also pushes for Macs in the enterprise.

172
00:15:32,510 --> 00:15:35,210
They have great hardware, great software.

173
00:15:35,750 --> 00:15:38,830
So hackers are obviously very opportunistic.

174
00:15:38,830 --> 00:15:43,190
So as they see an increase in targets, they're obviously going to start attacking them.

175
00:15:43,190 --> 00:15:47,390
So one of the things we see is we see hackers developing Mac-specific attacks.

176
00:15:47,390 --> 00:15:51,750
And we've seen this trend, I would say, in the last year or two, almost taking off.

177
00:15:51,750 --> 00:16:07,330
At the same time, in parallel, the other thing we see, and macros is a great example, is we see Windows-based attackers or Windows-based malware that have had success on the Windows platform kind of hoarding those techniques over.

178
00:16:07,330 --> 00:16:14,790
So obviously, as you mentioned, macros on Windows has a very illustrious history, a lot of success.

179
00:16:14,790 --> 00:16:18,890
So those same attacks can work on macros.

180
00:16:18,890 --> 00:16:22,050
So hackers are kind of like, hey, we know how these macros work.

181
00:16:22,050 --> 00:16:23,190
We have the infrastructure.

182
00:16:23,190 --> 00:16:24,610
We have experience.

183
00:16:24,670 --> 00:16:27,290
Why not target Mac users using this?

184
00:16:27,290 --> 00:16:36,910
So macros is probably the best example of traditionally Windows infection vector, let's say, being hoarded over or brought over to macros.

185
00:16:36,910 --> 00:16:41,030
I think in a direct response to Macs increasing in the enterprise.

186
00:16:41,030 --> 00:16:44,630
Because these macro-based attacks still require Microsoft products.

187
00:16:44,630 --> 00:16:51,310
And the average consumer is probably going to be using Apple's Office apps, which aren't susceptible to macro-based attacks.

188
00:16:51,310 --> 00:17:01,390
Whereas in the enterprise, I think that's where we see the uptick in the installation of these Microsoft products on Macs, thereby opening the door for these macro-based attacks.

189
00:17:01,390 --> 00:17:13,490
However, though, we also see, for example, adware that's been predominantly targeting Windows via Chrome on Windows or Edge or Internet Explorer.

190
00:17:13,530 --> 00:17:15,190
Same kind of idea, right?

191
00:17:15,190 --> 00:17:21,430
Hackers and malware writers have success on that and say, hey, we can port these to Mac pretty easily.

192
00:17:21,430 --> 00:17:27,010
It's kind of cross-platform, these techniques and these malicious extensions we create.

193
00:17:27,010 --> 00:17:32,370
So, you know, why don't we start targeting Mac users because they're growing in numbers.

194
00:17:32,370 --> 00:17:42,990
So we're definitely seeing more and more of these Windows, these kind of like old school or very well-known Windows-based infection vectors and attacks now kind of showing up targeting Macs specifically.

195
00:17:42,990 --> 00:17:55,490
And it's interesting because I think Mac users maybe are at more risk because, you know, it's like what Mac user thinks that they can get a macro virus on their Mac, like zero, right?

196
00:17:55,490 --> 00:18:01,450
Traditionally, Apple's marketing has kind of put out the message that Macs are immune.

197
00:18:01,790 --> 00:18:04,250
And so a lot of Mac users believe that.

198
00:18:04,250 --> 00:18:10,530
So whereas someone on a Windows computer might not open a Word document from a random email, a Mac user might.

199
00:18:10,530 --> 00:18:20,210
So hackers may be having a better success rate actually by targeting Mac users, you know, using these kind of well-known techniques that might not fly on Windows anymore.

200
00:18:20,210 --> 00:18:28,470
Or for that matter, not know that the office on the Mac can support some of that stuff that would be also running over on the Windows side, right?

201
00:18:28,730 --> 00:18:33,270
You know, I wouldn't expect a VPK macro to just go ahead and run okay.

202
00:18:33,270 --> 00:18:34,410
It's crazy town.

203
00:18:35,310 --> 00:18:36,450
We love it.

204
00:18:38,110 --> 00:18:44,930
There was a little bit of a follow up from JKBCKR who asked the plist question.

205
00:18:44,930 --> 00:18:46,870
I'll just pop this out here.

206
00:18:46,870 --> 00:18:47,710
Oh, I got it.

207
00:18:47,710 --> 00:18:58,330
The zip was placed into the library and extracted a folder called launch agents with the plist inside, which is the correct location for launch agents.

208
00:18:58,870 --> 00:19:02,070
Okay, so a quick follow up if that's okay.

209
00:19:02,130 --> 00:19:05,990
Does this only work if there was a no launch agents initially?

210
00:19:05,990 --> 00:19:11,170
Otherwise, archive utility would rename that launch agents to, right?

211
00:19:11,310 --> 00:19:13,550
Yes, and that's actually a really good point.

212
00:19:13,550 --> 00:19:22,750
So the reason this generally works is because on a default install of macOS, there's no launch agent directory under the user's directory.

213
00:19:23,230 --> 00:19:26,450
So there is one in the slash library directory.

214
00:19:26,450 --> 00:19:29,250
We couldn't write to that location from the sandbox.

215
00:19:29,250 --> 00:19:32,590
So what we could do, though, is we could write to the user's library directory, right?

216
00:19:32,590 --> 00:19:40,850
To the slash library, put a specially crafted zip file there, and then the archive utility would create the launch agent directory for us.

217
00:19:40,850 --> 00:19:49,550
Because, again, we could also not create or write a plist to that directory because Microsoft's patch specifically forbade that.

218
00:19:49,550 --> 00:19:55,250
So, yes, if that launch agent directory is already there, this specific attack venue would fail.

219
00:19:55,250 --> 00:20:07,530
What we could possibly do, though, is create files in other locations and perhaps create a .bashrc file or some other file that leads to code execution.

220
00:20:07,530 --> 00:20:15,030
Someone also mentioned perhaps you could do something with symlinks, so maybe make a zip file with symlinks.

221
00:20:15,030 --> 00:20:16,850
I haven't really dug into that.

222
00:20:16,950 --> 00:20:26,670
But I think the fact that we can, outside the sandbox, create kind of arbitrary files, the launch agent path was really just the first one I tried that worked.

223
00:20:26,670 --> 00:20:35,870
But there might be other venues that are more globally applicable that, for example, wouldn't fail if the launch agent directory was already there.

224
00:20:35,870 --> 00:20:39,910
So that's a really good question and an excellent point to make.

225
00:20:42,150 --> 00:20:42,830
Excellent.

226
00:20:42,830 --> 00:20:43,510
Okay.

227
00:20:43,810 --> 00:20:47,690
We'll step back for a second to Sneakernet has another question.

228
00:20:47,690 --> 00:20:51,230
Are there any Apple-specific protocols you found really interesting?

229
00:20:51,230 --> 00:20:55,590
Protocols can be either in a process in the same system or between devices.

230
00:20:55,590 --> 00:20:59,330
This is, for example, Sidecar between laptop and iPad.

231
00:21:00,210 --> 00:21:10,410
Yeah, so the IPC mechanisms in macOS are full of security vulnerabilities or have been in the past.

232
00:21:10,490 --> 00:21:15,290
So one great example is just the handling of these custom URL schemes.

233
00:21:15,290 --> 00:21:27,750
So it turns out that if an application supports a file format or supports a custom URL scheme, a custom URL scheme can be like blah, colon, slash, slash, anything.

234
00:21:28,310 --> 00:21:29,790
You know, HTTP would be one example.

235
00:21:29,790 --> 00:21:36,270
But applications can also create their own custom URL handlers as a kind of lightweight IPC mechanism.

236
00:21:36,270 --> 00:21:37,910
And this is used legitimately.

237
00:21:38,550 --> 00:21:49,470
If an application contains a custom URL handler, as soon as it hits the file system, macOS actually parses that application and registers it as a custom URL handler.

238
00:21:49,470 --> 00:21:53,350
A URL can then be launched from the browser.

239
00:21:53,450 --> 00:22:02,690
Luckily, recent versions of browsers now will alert the user, basically saying, hey, a web page is trying to make a custom URL request.

240
00:22:02,690 --> 00:22:04,890
But in the past, that was not the case.

241
00:22:04,890 --> 00:22:11,710
And we actually saw the Wingtail APT group abuse this technique to target Mac users specifically.

242
00:22:11,730 --> 00:22:14,350
So their exploit, you browse through a website.

243
00:22:14,350 --> 00:22:18,890
In the background, it would download an application that handled a custom URL scheme.

244
00:22:18,890 --> 00:22:25,830
macOS would automatically register that behind the scenes as soon as that application hit the file system.

245
00:22:26,230 --> 00:22:32,150
Their exploit code would then just make a URL request from the malicious website, which is totally legitimate.

246
00:22:32,150 --> 00:22:33,230
It's something you can do.

247
00:22:33,930 --> 00:22:36,950
macOS would look and say, hey, yeah, I have an application that can handle that.

248
00:22:36,950 --> 00:22:42,730
And then blindly and naively launch the malware, which had just been downloaded because it had this custom URL.

249
00:22:42,730 --> 00:22:53,510
So these custom URL schemes are kind of a Mac-specific protocol or an IPC mechanism where there are some interesting issues, especially in the past.

250
00:22:53,670 --> 00:22:58,910
I think my other favorite protocol or IPC mechanism is XPC.

251
00:22:59,170 --> 00:23:02,970
Ian Beer at Google has done some great work finding all sorts of vulnerabilities.

252
00:23:03,270 --> 00:23:08,810
Some other Google Project Zero, such as Brandon, researchers have found bugs as well.

253
00:23:08,810 --> 00:23:14,050
And basically, XPC is just a way where a client can talk to usually a privileged server.

254
00:23:14,710 --> 00:23:21,010
And so it's really good to kind of enumerate the API endpoints that the server has.

255
00:23:21,010 --> 00:23:32,550
And the biggest issue is usually it doesn't correctly validate the client, which means once you're on the system, you perhaps can talk to a trusted service and do all sorts of nasty things.

256
00:23:32,550 --> 00:23:37,130
It's often application-specific based on the XPC server.

257
00:23:37,150 --> 00:23:39,810
But Apple has had all sorts of issues here.

258
00:23:39,810 --> 00:23:44,650
So, for example, the well-known root pipe vulnerability was a great example.

259
00:23:44,650 --> 00:23:48,710
There was an XPC service running on macOS as root.

260
00:23:48,830 --> 00:23:54,870
And it would, I think, create random arbitrary files and run arbitrary commands as root.

261
00:23:54,870 --> 00:23:56,650
And it didn't validate the client.

262
00:23:56,650 --> 00:24:03,650
So as soon as you were on the box, you could just send this XPC protocol request to this XPC service that was running.

263
00:24:03,650 --> 00:24:05,670
And it would be like, yeah, I'll run whatever you say.

264
00:24:05,670 --> 00:24:09,710
And so it was like the easiest, best privileged escalation vulnerability.

265
00:24:09,910 --> 00:24:13,610
So XPC, great protocol, Apple-specific.

266
00:24:13,890 --> 00:24:22,010
I always look at what kind of servers and applications, if they have an XPC interface, and start auditing those because oftentimes there are security issues there.

267
00:24:23,210 --> 00:24:25,690
That's your big blinking red light, huh?

268
00:24:25,690 --> 00:24:28,650
Yeah, like poke on that hard.

269
00:24:29,910 --> 00:24:33,170
Okay, so we have found ourselves in the last five minutes on this.

270
00:24:33,170 --> 00:24:37,670
If we have any more really good questions you want to drop in here, then please do.

271
00:24:37,670 --> 00:24:51,990
In the meantime, this is when I've taken to asking people if they have a general call to action, something you would like us to take away from the presentation that you've done, something that you'd like us all to consider and move forward with.

272
00:24:52,690 --> 00:25:03,390
Yeah, I mean, I think, you know, this is probably obvious to anyone listening here, but a lot of Mac users think that Macs are infallible.

273
00:25:03,390 --> 00:25:15,750
And this actually puts themselves at risk because, you know, a lot of Windows users will maybe participate in best cyber-safe practices, whatever that means.

274
00:25:15,750 --> 00:25:21,430
You know, don't download random apps, click random links in emails, run random applications.

275
00:25:21,430 --> 00:25:24,910
Whereas on macOS, people are prone to do that a little more.

276
00:25:24,930 --> 00:25:28,410
So, you know, just realizing Macs are just as hackable as Windows.

277
00:25:28,410 --> 00:25:33,750
It's an operating system that runs code, so just kind of stick with that.

278
00:25:33,790 --> 00:25:38,270
The other thing, and this is kind of a self-plug, but it's for free content, so I don't feel bad.

279
00:25:38,570 --> 00:25:45,330
In my presentation, I announced the free macOS book series I'm working on.

280
00:25:45,330 --> 00:25:54,950
So if you go to taomm.org, theartofmacmalware.org, I'm working on a free book about Mac malware analysis.

281
00:25:54,950 --> 00:26:00,610
So it talks a lot about infection vectors, these property lists, this XPC stuff.

282
00:26:00,610 --> 00:26:05,450
So if you're interested in, you know, Mac malware, vulnerability research, check it out.

283
00:26:05,450 --> 00:26:06,430
It's all free.

284
00:26:06,430 --> 00:26:10,110
The content, I've published the first part of the first volume.

285
00:26:10,110 --> 00:26:12,930
It's actually commentable on.

286
00:26:12,930 --> 00:26:19,910
So, you know, if you see an error or you want some input, you can just add a little comment, and I will add that into the content.

287
00:26:20,150 --> 00:26:21,470
And again, it's a free resource.

288
00:26:21,470 --> 00:26:32,410
It's basically trying to help provide more information for the community so that we can combat kind of the rising tide of Mac malware that's definitely coming.

289
00:26:32,930 --> 00:26:34,850
Well, that's something I can look forward to as well.

290
00:26:34,850 --> 00:26:35,370
So thank you.

291
00:26:35,370 --> 00:26:49,370
If you would be so kind as to drop the URL for that in the track one, and if you are willing to do so with any other contact information for you or a Twitter profile or something you want people to follow, that would be a good place for that.

292
00:26:49,750 --> 00:26:52,850
Yeah, and I'll put my Twitter, my DMs are open.

293
00:26:52,850 --> 00:26:54,530
Obviously, I'm very passionate about this.

294
00:26:54,530 --> 00:26:56,870
I love to nerd out, talk about this.

295
00:26:56,870 --> 00:27:00,630
So any questions, shoot me a DM, and we'll chat.

296
00:27:00,830 --> 00:27:01,870
Excellent.

297
00:27:02,390 --> 00:27:03,590
Thank you.

298
00:27:03,850 --> 00:27:09,210
We've gotten to the end of the questions in the live Q&A chat.

299
00:27:10,270 --> 00:27:20,250
I think that you've been a fantastic guest here, and we really appreciate your willingness to come and build a presentation and then spend some time with us in the Q&A.

300
00:27:20,990 --> 00:27:22,530
Yeah, thank you.

301
00:27:22,530 --> 00:27:24,610
Like I said, it's always an honor to talk at DEF CON.

302
00:27:24,610 --> 00:27:29,730
I just feel super appreciative to be able to share my research with just the DEF CON community.

303
00:27:29,730 --> 00:27:32,350
I mean, they're just the best.

304
00:27:33,010 --> 00:27:36,510
Well, we're the best because of the people who decide to come out and do this stuff.

305
00:27:36,510 --> 00:27:37,770
So thank you all.

306
00:27:39,130 --> 00:27:41,810
It seems like that's about all we have.

307
00:27:41,810 --> 00:27:47,730
So anybody who wants to do any follow-up on this one, you'll have some contact information showing up.

308
00:27:47,730 --> 00:27:50,850
And thank you all for showing up, and we'll do more later.

309
00:27:50,850 --> 00:27:51,410
Cool.

310
00:27:51,430 --> 00:27:52,310
See you guys later.

311
00:27:52,310 --> 00:27:53,250
Thanks for coming.

312
00:27:53,330 --> 00:27:54,070
Aloha.