When the Macintosh computer was new, Apple advertised that Macs, unlike PCs, were virus-free. Now we know better; Macs are plagued with malware, including ransomware. But the fact is that macOS is inherently more secure than Windows. That’s why security researcher Thijs Alkemade’s claim to break every layer of macOS security with one attack is a punchline. An excited audience of Black Hat conference attendees, both in-person and virtual, clamored to hear details about this astonishing claim.
What makes MacOS so secure?
“I’ve been a Mac user my whole life,” Alkemade said. “It’s a system I know well. The first Mac platform was based on Unix. In this platform, users are security boundaries, but processes are not. For files, each file has an owner and nine flags define permissions. The root user has full access to modify all files, memory, even the kernel. This was the old model.
“System Integrity Protection (SIP) was introduced in 2015 with El Capitan,” he continued. “It put a layer of security between root users and the kernel, protecting the system from modifications even by the root user. Root access is no longer enough to compromise the system. One of the other names of this system is rootless. Some people think this means Apple will root, like iPhone. But it really just means that root is less powerful Dangerous operations require rights, and each version of macOS adds more and more restrictions.
“But … macOS is old, big, and established,” Alkemede said. “Many parts of the system were written before the security model changed. It is not possible to rebuild the entire system.”
He listed several techniques that could be used to enable process injection, but concluded that they are only incidental. “It’s much nicer to have a process injection that can be applied everywhere.”
Where is the security hole?
Where is the weakness? Alkemade didn’t keep listeners in suspense. “It’s in the saved state function,” he explained. “When you close, check a box if you want an app to reopen when you start again. It even restores unsaved documents. It works largely automatically. Developers don’t have to do anything to use it, but they can expand it.”
The process of saving the state of an application is called serialization and serialized data meant to be encrypted. However, no encryption is required, allowing a clever programmer to abuse this feature. “I create a saved state using a malicious serialized object and write it to another application’s state directory. It deserializes and runs automatically inside the other application, and can use the rights and permissions of this other application, achieving process injection”.
Alkemade walked the audience through the many barricades he encountered and the techniques he developed to circumvent them. He admitted, “I have to skip a few steps for time reasons and publicity reasons.” I won’t try to explain the details here, as you need to be a programmer to fully understand them. The key point is that it worked.
What you can do with process injection
Alkemade detailed three possible uses for the exploit: escaping the sandbox, escalating privilege, and bypassing system integrity protection.
These are extraordinary claims, given that these results are practically the Holy Grail of piracy. Bypassing SIP in particular gives your program supreme power. “We can read every user’s email or Safari history, or give us permission to use their microphone or webcam,” Alkemade explained. “Our process is now protected by SIP, which gives it powerful persistence. We can load a kernel extension without the user’s knowledge or permission.
Alkemade proceeded to demonstrate these three hacks for the appreciative audience. Only the best Black Hat demos get their own clap!
Should we be worried?
This security hole is already fixed in macOS Monterey, but app developers have to do their part. “Developers can and should just make apps accept for sure serialized objects,” Alkemade said. “Apple has already done this with all of its apps, but existing third-party apps must do the same.”
As it turns out, this new protection isn’t just for Monterey. “I just heard they took it to Big Sur and Catalina,” Alkemade said. “The Catalina release notes are up to date, but not the Big Sur ones. I got an unsolicited email from Apple asking me to share the content of my talk in advance. Two hours ago I got confirmation that it’s fixed in Big Sur, although I haven’t had time to verify.”
“Apple continues to add layers to macOS,” Alkemade concluded. “Adding new layers to an established system is difficult, so code written 10 years or more ago is today’s attack surface. More layers may not increase the effort of attackers, not if you can use the same bug to avoid them all.”