Stick That In Your (root)Pipe & Smoke It

Presented at DEF CON 23 (2015), Aug. 9, 2015, noon (60 minutes)

You may ask; "why would Apple add an XPC service that can create setuid files anywhere on the system - and then blindly allow any local user to leverage this service?" Honestly, I have no idea! The undocumented 'writeconfig' XPC service was recently uncovered by Emil Kvarnhammar, who determined its lax controls could be abused to escalate one's privileges to root. Dubbed ‘rootpipe,' this bug was patched in OS X 10.10.3. End of story, right? Nope, instead things then got quite interesting. First, Apple decided to leave older versions of OS X un-patched. Then, an astute researcher discovered that the OSX/XSLCmd malware which pre-dated the disclosure, exploited this same vulnerability as a 0day! Finally, yours truly, found a simple way to side-step Apple's patch to re-exploit the core vulnerability on a fully-patched system. So come attend (but maybe leave your MacBooks at home), as we dive into the technical details XPC and the rootpipe vulnerability, explore how malware exploited this flaw, and then fully detail the process of completely bypassing Apple's patch. The talk will conclude by examining Apple's response, a second patch, that appears to squash ‘rootpipe'…for now.

Presenters:

• Patrick Wardle - Director of R&D, Synack
  Patrick Wardle is the Director of Research at Synack, where he leads cyber R&D efforts. Having worked at NASA, the NSA, and Vulnerability Research Labs (VRL), he is intimately familiar with aliens, spies, and talking nerdy. Currently, Patrick’s focus is on automated vulnerability discovery, and the emerging threats of OS X and mobile malware. In his personal time, Patrick collects OS X malware and writes OS X security tools. Both can be found on his website Objective-See.com

Links:

• https://defcon.org/html/defcon-23/dc-23-speakers.html#Wardle2
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 slides/DEF CON 23 - Patrick Wardle - Stick That In Your root Pipe and Smoke It - Slides.mp4
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 video/DEF CON 23 - Patrick Wardle - Stick That In Your root Pipe and Smoke It - Video.mp4
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 slides/DEF CON 23 - Patrick Wardle - Stick That In Your root Pipe and Smoke It - Slides.srt (subtitles)
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 video and slides/DEF CON 23 - Patrick Wardle - Stick That In Your root Pipe and Smoke It - Video and Slides.srt (subtitles)
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 video/DEF CON 23 - Patrick Wardle - Stick That In Your root Pipe and Smoke It - Video.srt (subtitles)
• https://infocon.org/cons/DEF CON/DEF CON 23/DEF CON 23 video and slides/DEF CON 23 - Patrick Wardle - Stick That In Your root Pipe and Smoke It - Video and Slides.mp4 (Video and Slides)
• https://www.youtube.com/watch?v=pbpaUuGLS5g

Similar Presentations:

• Objective by the Sea version 3.0 (2020) / Abusing and Securing XPC in macOS Apps
• Black Hat USA 2015 / Writing Bad @$$ Malware for OS X
• Black Hat Europe 2018 / Drill Apple Core: Up and Down - Fuzz Apple Core Component in Kernel and User Mode for Fun and Profit