start	end	text
95180	98820	Make sure it's not just me who's seeing it weird.
104560	107100	So now they should see the three of us.
112330	114290	Oh yeah, I see us.
114650	115770	You see us?
115910	117670	Yeah, I just went to the Twitch stream.
117670	119510	Oh, excellent. Which Twitch stream?
122190	124730	I hear myself now, too.
125410	130050	Okay, that's fantastic. We are a professional organization here on a Friday night.
131190	134950	Yeah, we're going to call that one my fault. Okay, cool.
136310	139450	Welcome to Q&A with Patrick Wardle.
139450	146330	We are going to be talking about some macOS stuff and some stuff kind of adjacent to Microsoft Office.
147470	151970	I am Jurist, and the other goon that you see here is Fallible.
152110	155770	And we're going to be helping ask Patrick some questions this evening.
155770	158470	And it's good to see you all in the chat.
158470	163290	Patrick, why don't you take a minute to introduce yourself to everybody?
163290	167890	Because I know that in your talk, you kind of dove right in into your content.
167890	171590	So take a minute, say hello to everybody, tell us a little bit about yourself.
172210	175130	Sure. Aloha, my name is Patrick Wardle.
175130	178630	I am a principal security researcher at Jamf.
178630	185110	I'm also the creator of the Mac security website and tool suite, Objective-C.
185110	189430	I have been fortunate enough to talk at a few DEF CONs in the past.
189430	193610	It's always one of my favorite events to talk nerdy at.
193970	198750	This year, virtual, you know, a little bummed we didn't all get to hang out together in Vegas.
198750	201830	But I think it's important that we're all staying safe and healthy.
201890	206010	And actually connecting online is kind of super hacker-ish.
206010	211250	So I'm stoked you're all here to chat a little bit more about my talk, open Q&A.
211390	212750	Again, welcome.
213590	216890	Well, thank you for being here. We really appreciate it.
216890	221610	It's nice to get some folks who want to come present this way.
221750	227110	So Sneakernet gave us what they're considering to be a softball question.
227110	231270	Is SYLK the old file format you've come across?
231270	237810	Is there a way to programmatically scan macOS apps for what kind of files they handle?
237810	240810	Entitlements? Particular API usage?
241890	243870	Yeah, so that's a great question.
243870	249650	The first place I would look at is in something called the Launch Services Database.
249650	254130	And you can enumerate this with the ls register command.
254130	263130	And what it will basically do is it will dump all the file type and application associations on your macOS system.
263130	267690	So for example, you can see what applications have registered for HTML files.
267690	271170	What applications have registered to handle documents.
271190	276730	In this case, what type of applications perhaps support these SYLK files.
276730	281050	So that's kind of where I would start. It gives you a global overview of that.
281250	284910	So if you just Google ls register, again, it's a macOS command.
284910	288310	You run it with the dash dump flag and it will dump this database.
288490	294430	You can also look at an application's info.plist file, which is something that all applications have.
294430	299770	And in there, they can have a set, it's actually an array, a dictionary of key value pairs
299770	306750	that kind of tell the operating system what type of applications, sorry, what kind of files they support.
306750	310170	And this is actually how that database gets populated.
310290	315970	So for example, Microsoft Office lists the doc files and file formats it supports.
315970	321250	Obviously a browser will have a large list including HTML files, probably PDFs, etc.
321250	326010	That's a great place to start because then you can see the file formats.
326010	331110	And then I would look at the more esoteric or unrecognized ones and start fuzzing or playing with that.
331110	336790	Because it's kind of mentioned in my talk, the reason that this vulnerability existed,
336790	343150	specifically the automatic execution of macros, was that Microsoft actually has two separate code paths
343150	346690	for handling macros based on these file types.
346690	352150	Obviously the main one for documents, and then a whole separate archaic code path
352150	355530	that probably no one ever looked at for these older file formats.
355530	359670	Always a good idea to look for these more esoteric, ancient file formats
359670	361950	because there's a lot of security bugs there.
361950	366490	Because they were created in a time when security wasn't really a priority.
367450	374710	Any time an afterthought gets pulled forward into what's happening now is probably an interesting space.
374710	375750	Exactly.
377930	381870	Cool. Next question coming in also from Sneakernet.
381930	384770	Is there a way to programmatically scan Mac apps?
384770	388270	Oh, we did that one already. Let's see here.
388270	392710	Have you considered trying to do something similar to this kind of research with iPad OS
393330	399070	or any other kind of non-Windows OS or mobile OS?
400070	404450	That's a great question. I predominantly focus on Mac for two reasons.
404450	410330	First, my personal opinion is it's really good to get really niche in whatever area that interests.
410330	416550	That's just something that I've found to kind of have a lot of success in my InfoSec security career.
416850	425950	The other fact, and yes, I will admit this, is hacking Mac is far simpler than hacking an iOS operating system or iPad OS.
426070	430010	Largely, this is just because of how locked down that operating system is.
430010	435510	So I think there has been some research done in the past based on custom URL handling,
435510	442510	which is largely how applications and certain file formats are kind of connected in a way on iOS.
442790	448410	But even if you found some interesting issues there, you would have to break out of the sandbox
448410	455490	and then deal with a lot of the extra constraints that iOS and iPad OS kind of stack on top.
455490	459030	That with Mac OS, you really don't have to worry about compulsion.
459030	464250	We did have to find a new sandbox escape, but we showed that was pretty trivial to do.
464250	466030	And there's been kind of history of that.
466170	471130	So, you know, the TLDR, iOS is just really a hard target.
471510	474470	So I'll probably just stick with Macs for now.
474730	484310	So that's an interesting statement, though, that you found that getting really niche is the thing that helps you continue to find new interesting vulnerabilities.
484310	487730	So you're keeping your target list really small.
487730	490130	Can you talk about that any more?
490130	495250	And what are some of the strengths that that's bringing you?
495250	501130	And can you think of anything that you're missing that maybe if there was one more thing you wanted to add?
502190	507770	Yeah, I know. And that's something that, you know, as I grow older and wiser, it's something that resonates really well with me.
507770	516310	So, you know, a long time ago, I used to work at the NSA, National Security Agency, everyone's favorite U.S. government spy agency.
516310	518850	And I remember when I got there, I was an intern.
519130	525970	And the intern program, you kind of bounce around from different offices, kind of sampling different activities, let's say.
526010	535950	And I remember thinking, I want to be good at all of this, like crypto and like mercenary malware, writing Windows exploits and hacking satellites, like all the really cool stuff the NSA does.
536430	542290	And I got to a point where I was like, you know, it's just impossible to have depth in so much breadth.
542570	545750	So I said, look, I'm going to kind of focus on one specific thing.
546350	551430	And actually, it was only when I left the NSA was when I really started focusing on Macs.
551650	557910	The reason for that was, at the NSA, I did predominantly Windows stuff.
558290	565130	And so when I left, I wanted to still use my foundational skills of reverse engineering, vulnerability discovery, exploit development.
565130	567270	But I didn't want to do it on the same platform.
567270	571550	I was kind of poking around with the NSA, just it's good not to cross any lines.
571550	573470	And, you know, you don't want to piss off the NSA.
573470	575470	I said, hey, look, let me focus on Mac.
575690	580670	I can use my same skill sets, but it's a separate platform, so I probably won't step on any of those.
582030	585630	And moving forward with that, I really kind of doubled down on that.
585630	589490	And it really allowed me to get a lot of depth in the topic.
589490	601310	And I've noticed for, you know, finding new vulnerabilities, giving conference talks, right, at least for me, having that depth has really allowed me to become somewhat of an expert in the space, I would say.
601310	609990	And allowed me to really dig more into maybe the more esoteric parts of the operating system where a lot of vulnerabilities lie.
609990	618110	Whereas if I was trying to do that across maybe multiple operating systems and multiple platforms, it's just, I think, impossible to gain that much depth.
618110	620630	So that's something that's just really worked for me.
620630	630030	I would say the one downside is sometimes you might miss attacks that work on one platform that might have a conceptually similar vulnerability on that class.
630030	634150	One great example I can think of is DLL or dynamic hijacking.
634150	637610	This is a very common kind of attack scenario on Windows.
637890	649190	And I, you know, when I was still kind of coming into the Mac space, I decided to see if macOS was vulnerable, at least conceptually, to the idea of hijacking dynamic libraries based on search path.
649190	654710	And it turned out it was, and I just happened to be the first person that kind of dug into that and talked about it.
654710	660630	So I still think it's good to keep your eyes and ears open and see what other research other people are doing.
661290	665870	Just to be inspired and then kind of say, hey, is this something I can bring into my platform?
666350	673990	But again, I've had a lot of success really focusing just on one platform, you know, macOS, not even iOS as much.
674030	678350	So again, to me, that's worked really well, and I think it's a good nugget of advice.
678350	686770	Yeah, thank you for talking about that a bit, because it's nice to hear somebody who's gotten a lot of success with a pattern like that,
686770	691930	because there's many different patterns that I've been hearing about even this weekend.
691930	695030	So it's nice to get that reinforcement.
695230	698510	Yeah, I would agree with that, because I do a lot of digital forensics, right?
698590	704470	And, you know, so I see a lot of Windows stuff come across, and I see a lot of iOS stuff, and it's kind of difficult to know,
704470	710310	hey, you know, if I'm going to dedicate some time to build up some skills, you know, should it be broad-based, should it be targeted?
710310	714050	And again, I'm digging what you're throwing down there.
715530	721670	Next question. Okay, so you showed how putting a zip file into the login items,
721670	726270	that in turn contains a plist with a launch agent, right?
726270	731470	So does macOS really register launch agents on the creation of the file?
731470	734910	In this case, creating it via an on-zip.
737110	742110	Almost. So actually what it does is it automatically processes it on the next login.
742110	747450	So it doesn't trigger it right away on creation, but on the next login,
747450	753630	macOS will automatically just enumerate all the property lists that are created in the launch agent directory.
753630	758570	It does the same thing with launch statements. And any property list it finds, it just runs it.
758570	767550	So that's really kind of a neat thing that we were able to leverage as a mechanism to get this kind of code execution outside the sandbox.
767550	773470	The only downside is you then have to kind of wait until the user re-logs in.
773470	779970	But, you know, I like to say, you know, humans are impatient, but our exploits, our malware, you know, don't have to be, right?
779970	790050	If we drop this launch agent and we have to wait two or three days, or even a week, until the user re-logs in, and then we get a callback, like, so be it, right?
790050	792770	Generally we're not in that much of a rush.
792770	800610	But it is interesting that macOS kind of automatically runs those, and something that we can, in this scenario, leverage to our own benefit.
802210	805110	Sure. Follow-up from the same person that asked the question.
805110	808450	Any plist it can find on the file system?
809870	821450	No, it actually has to be in the launch agent directory, which is either in tilde user slash library launch agent or slash library slash launch agents.
821450	824690	So macOS will look in those specific directories.
824690	828150	It looks for other items in other directories.
828150	833890	For example, there are other launch daemon directories, which it looks for other property lists.
833890	837830	But again, those have to be in those specific directories.
838450	844350	Cool. So, you know, a lot of this starts by you talking about macro attacks.
844350	848010	And macro attacks have been popular on Windows for a long time.
848010	857350	In fact, using macros inside of Office documents, I mean, you and I are roughly the same age, that's how you would get out of, like, the net nanny kind of stuff?
857350	865390	Or you get around the stuff that they put on stuff at high school or middle school so you couldn't get on the internet, right?
865390	866370	You know? Yeah.
866370	869150	Sensual limitations is good? Well, it's fine now.
870290	875470	So it is bananas to me that this stuff kind of persists now.
875830	882330	Do you think that this is kind of a trend towards macro-based attacks towards macOS?
882330	891270	Or is this just kind of a situation where, you know, the guys are, you know, if you've got a hammer in your hand, everything looks like a nail kind of a situation?
892410	897710	Yeah, no, it's interesting because I think, well, we see two things happening.
897710	899490	Maps are definitely becoming more prevalent.
899810	905130	You know, we've seen this, especially in the consumer space, but now also in the enterprise space.
905130	908110	And I think that's one of the reasons this is very anecdotal.
908110	910270	I don't have necessarily data to back this up.
910270	915730	But, you know, you go to a college campus even three or four or five years ago, everyone has Macs, right?
915890	920290	And now those students have graduated or entered the workforce.
920370	922110	What do they want? They want Mac computers.
922370	923490	Understandably so, right?
923570	928110	So we're kind of starting to see growth in the enterprise of Macs as well.
928110	932510	Apple obviously also pushes for Macs in the enterprise.
932510	935210	They have great hardware, great software.
935750	938830	So hackers are obviously very opportunistic.
938830	943190	So as they see an increase in targets, they're obviously going to start attacking them.
943190	947390	So one of the things we see is we see hackers developing Mac-specific attacks.
947390	951750	And we've seen this trend, I would say, in the last year or two, almost taking off.
951750	967330	At the same time, in parallel, the other thing we see, and macros is a great example, is we see Windows-based attackers or Windows-based malware that have had success on the Windows platform kind of hoarding those techniques over.
967330	974790	So obviously, as you mentioned, macros on Windows has a very illustrious history, a lot of success.
974790	978890	So those same attacks can work on macros.
978890	982050	So hackers are kind of like, hey, we know how these macros work.
982050	984610	We have the infrastructure. We have experience.
984670	987290	Why not target Mac users using this?
987290	996910	So macros is probably the best example of traditionally Windows infection vector, let's say, being hoarded over or brought over to macros.
996910	1001030	I think in a direct response to Macs increasing in the enterprise.
1001030	1004630	Because these macro-based attacks still require Microsoft products.
1004630	1011310	And the average consumer is probably going to be using Apple's Office apps, which aren't susceptible to macro-based attacks.
1011310	1021390	Whereas in the enterprise, I think that's where we see the uptick in the installation of these Microsoft products on Macs, thereby opening the door for these macro-based attacks.
1021390	1033490	However, though, we also see, for example, adware that's been predominantly targeting Windows via Chrome on Windows or Edge or Internet Explorer.
1033530	1035190	Same kind of idea, right?
1035190	1041430	Hackers and malware writers have success on that and say, hey, we can port these to Mac pretty easily.
1041430	1047010	It's kind of cross-platform, these techniques and these malicious extensions we create.
1047010	1052370	So, you know, why don't we start targeting Mac users because they're growing in numbers.
1052370	1062990	So we're definitely seeing more and more of these Windows, these kind of like old school or very well-known Windows-based infection vectors and attacks now kind of showing up targeting Macs specifically.
1062990	1075490	And it's interesting because I think Mac users maybe are at more risk because, you know, it's like what Mac user thinks that they can get a macro virus on their Mac, like zero, right?
1075490	1081450	Traditionally, Apple's marketing has kind of put out the message that Macs are immune.
1081790	1084250	And so a lot of Mac users believe that.
1084250	1090530	So whereas someone on a Windows computer might not open a Word document from a random email, a Mac user might.
1090530	1100210	So hackers may be having a better success rate actually by targeting Mac users, you know, using these kind of well-known techniques that might not fly on Windows anymore.
1100210	1108470	Or for that matter, not know that the office on the Mac can support some of that stuff that would be also running over on the Windows side, right?
1108730	1114410	You know, I wouldn't expect a VPK macro to just go ahead and run okay. It's crazy town.
1115310	1116450	We love it.
1118110	1124930	There was a little bit of a follow up from JKBCKR who asked the plist question.
1124930	1126870	I'll just pop this out here.
1126870	1138330	Oh, I got it. The zip was placed into the library and extracted a folder called launch agents with the plist inside, which is the correct location for launch agents.
1138870	1142070	Okay, so a quick follow up if that's okay.
1142130	1145990	Does this only work if there was a no launch agents initially?
1145990	1151170	Otherwise, archive utility would rename that launch agents to, right?
1151310	1153550	Yes, and that's actually a really good point.
1153550	1162750	So the reason this generally works is because on a default install of macOS, there's no launch agent directory under the user's directory.
1163230	1166450	So there is one in the slash library directory.
1166450	1169250	We couldn't write to that location from the sandbox.
1169250	1172590	So what we could do, though, is we could write to the user's library directory, right?
1172590	1180850	To the slash library, put a specially crafted zip file there, and then the archive utility would create the launch agent directory for us.
1180850	1189550	Because, again, we could also not create or write a plist to that directory because Microsoft's patch specifically forbade that.
1189550	1195250	So, yes, if that launch agent directory is already there, this specific attack venue would fail.
1195250	1207530	What we could possibly do, though, is create files in other locations and perhaps create a .bashrc file or some other file that leads to code execution.
1207530	1215030	Someone also mentioned perhaps you could do something with symlinks, so maybe make a zip file with symlinks.
1215030	1216850	I haven't really dug into that.
1216950	1226670	But I think the fact that we can, outside the sandbox, create kind of arbitrary files, the launch agent path was really just the first one I tried that worked.
1226670	1235870	But there might be other venues that are more globally applicable that, for example, wouldn't fail if the launch agent directory was already there.
1235870	1239910	So that's a really good question and an excellent point to make.
1242150	1243510	Excellent. Okay.
1243810	1247690	We'll step back for a second to Sneakernet has another question.
1247690	1251230	Are there any Apple-specific protocols you found really interesting?
1251230	1255590	Protocols can be either in a process in the same system or between devices.
1255590	1259330	This is, for example, Sidecar between laptop and iPad.
1260210	1270410	Yeah, so the IPC mechanisms in macOS are full of security vulnerabilities or have been in the past.
1270490	1275290	So one great example is just the handling of these custom URL schemes.
1275290	1283330	So it turns out that if an application supports a file format or supports a custom URL scheme,
1283330	1287750	a custom URL scheme can be like blah, colon, slash, slash, anything.
1288310	1289790	You know, HTTP would be one example.
1289790	1296270	But applications can also create their own custom URL handlers as a kind of lightweight IPC mechanism.
1296270	1297910	And this is used legitimately.
1298550	1309470	If an application contains a custom URL handler, as soon as it hits the file system, macOS actually parses that application and registers it as a custom URL handler.
1309470	1313350	A URL can then be launched from the browser.
1313450	1322690	Luckily, recent versions of browsers now will alert the user, basically saying, hey, a web page is trying to make a custom URL request.
1322690	1324890	But in the past, that was not the case.
1324890	1331710	And we actually saw the Wingtail APT group abuse this technique to target Mac users specifically.
1331730	1334350	So their exploit, you browse through a website.
1334350	1338890	In the background, it would download an application that handled a custom URL scheme.
1338890	1345830	macOS would automatically register that behind the scenes as soon as that application hit the file system.
1346230	1352150	Their exploit code would then just make a URL request from the malicious website, which is totally legitimate.
1352150	1353230	It's something you can do.
1353930	1356950	macOS would look and say, hey, yeah, I have an application that can handle that.
1356950	1362730	And then blindly and naively launch the malware, which had just been downloaded because it had this custom URL.
1362730	1373510	So these custom URL schemes are kind of a Mac-specific protocol or an IPC mechanism where there are some interesting issues, especially in the past.
1373670	1378910	I think my other favorite protocol or IPC mechanism is XPC.
1379170	1382970	Ian Beer at Google has done some great work finding all sorts of vulnerabilities.
1383270	1388810	Some other Google Project Zero, such as Brandon, researchers have found bugs as well.
1388810	1394050	And basically, XPC is just a way where a client can talk to usually a privileged server.
1394710	1401010	And so it's really good to kind of enumerate the API endpoints that the server has.
1401010	1412550	And the biggest issue is usually it doesn't correctly validate the client, which means once you're on the system, you perhaps can talk to a trusted service and do all sorts of nasty things.
1412550	1417130	It's often application-specific based on the XPC server.
1417150	1419810	But Apple has had all sorts of issues here.
1419810	1424650	So, for example, the well-known root pipe vulnerability was a great example.
1424650	1428710	There was an XPC service running on macOS as root.
1428830	1434870	And it would, I think, create random arbitrary files and run arbitrary commands as root.
1434870	1436650	And it didn't validate the client.
1436650	1443650	So as soon as you were on the box, you could just send this XPC protocol request to this XPC service that was running.
1443650	1445670	And it would be like, yeah, I'll run whatever you say.
1445670	1449710	And so it was like the easiest, best privileged escalation vulnerability.
1449910	1453610	So XPC, great protocol, Apple-specific.
1453890	1462010	I always look at what kind of servers and applications, if they have an XPC interface, and start auditing those because oftentimes there are security issues there.
1463210	1465690	That's your big blinking red light, huh?
1465690	1468650	Yeah, like poke on that hard.
1469910	1473170	Okay, so we have found ourselves in the last five minutes on this.
1473170	1477670	If we have any more really good questions you want to drop in here, then please do.
1477670	1484150	In the meantime, this is when I've taken to asking people if they have a general call to action,
1484150	1491990	something you would like us to take away from the presentation that you've done, something that you'd like us all to consider and move forward with.
1492690	1503390	Yeah, I mean, I think, you know, this is probably obvious to anyone listening here, but a lot of Mac users think that Macs are infallible.
1503390	1515750	And this actually puts themselves at risk because, you know, a lot of Windows users will maybe participate in best cyber-safe practices, whatever that means.
1515750	1521430	You know, don't download random apps, click random links in emails, run random applications.
1521430	1524910	Whereas on macOS, people are prone to do that a little more.
1524930	1528410	So, you know, just realizing Macs are just as hackable as Windows.
1528410	1533750	It's an operating system that runs code, so just kind of stick with that.
1533790	1538270	The other thing, and this is kind of a self-plug, but it's for free content, so I don't feel bad.
1538570	1545330	In my presentation, I announced the free macOS book series I'm working on.
1545330	1554950	So if you go to taomm.org, theartofmacmalware.org, I'm working on a free book about Mac malware analysis.
1554950	1560610	So it talks a lot about infection vectors, these property lists, this XPC stuff.
1560610	1565450	So if you're interested in, you know, Mac malware, vulnerability research, check it out.
1565450	1570110	It's all free. The content, I've published the first part of the first volume.
1570110	1572930	It's actually commentable on.
1572930	1577070	So, you know, if you see an error or you want some input, you can just add a little comment,
1577070	1579910	and I will add that into the content.
1580150	1581470	And again, it's a free resource.
1581470	1585710	It's basically trying to help provide more information for the community
1585710	1592410	so that we can combat kind of the rising tide of Mac malware that's definitely coming.
1592930	1594850	Well, that's something I can look forward to as well.
1594850	1595370	So thank you.
1595370	1600090	If you would be so kind as to drop the URL for that in the track one,
1600090	1605890	and if you are willing to do so with any other contact information for you or a Twitter profile
1605890	1609370	or something you want people to follow, that would be a good place for that.
1609750	1612850	Yeah, and I'll put my Twitter, my DMs are open.
1612850	1614530	Obviously, I'm very passionate about this.
1614530	1616870	I love to nerd out, talk about this.
1616870	1620630	So any questions, shoot me a DM, and we'll chat.
1620830	1623590	Excellent. Thank you.
1623850	1629210	We've gotten to the end of the questions in the live Q&A chat.
1630270	1633450	I think that you've been a fantastic guest here,
1633450	1637290	and we really appreciate your willingness to come and build a presentation
1637290	1640250	and then spend some time with us in the Q&A.
1640990	1642530	Yeah, thank you.
1642530	1644610	Like I said, it's always an honor to talk at DEF CON.
1644610	1649730	I just feel super appreciative to be able to share my research with just the DEF CON community.
1649730	1652350	I mean, they're just the best.
1653010	1656510	Well, we're the best because of the people who decide to come out and do this stuff.
1656510	1657770	So thank you all.
1659130	1661810	It seems like that's about all we have.
1661810	1667730	So anybody who wants to do any follow-up on this one, you'll have some contact information showing up.
1667730	1670850	And thank you all for showing up, and we'll do more later.
1670850	1673250	Cool. See you guys later. Thanks for coming.
1673330	1674070	Aloha.