Presented at
Objective by the Sea version 6.0 (2023),
Oct. 12, 2023, 2:40 p.m.
(25 minutes).
MacOS is known for an additional layer of privacy controls called TCC - Transparency, Consent, and Control (TCC) that restricts access to sensitive personal resources: documents, camera, microphone, emails, and more. Granting such access requires authorization, and the mechanism's main design concern was clear user consent. \n\n Despite many vulnerabilities in that mechanism found in the past, using 0-days during red teaming engagements is impractical. Apple fixes TCC vulnerabilities but red teams still have to get access to files saved on the victim’s desktop or be able to take a screenshot. \n\n What if I tell you that there are many open doors to resolve all the TCC problems that are already installed on your target machines?! Electron apps are everywhere - Microsoft Teams, Slack, Discord, GitHub Desktop, Visual Studio Code… And you probably heard the joke that: 'S' in Electron stands for security.\n\n In this talk, I will share a new tool that, by abusing Electron default configuration, allows executing code in the context of those Electron apps and thus inherit their TCC permissions. It’s a technique that doesn’t touch files of those apps so it also bypasses the new macOS Ventura App Protection mechanism. \n\n The audience will leave with a solid understanding of the macOS privacy restrictions framework (TCC) and its weaknesses. The part of the audience interested in macOS red teaming will also get to know my new, free, and open-source tool. Blue teams on the stage will also see some ideas regarding detections.
Presenters:
-
Wojciech Regula
- Principal Security Consultant at SecuRing
Wojciech Reguła is a Principal Security Consultant working at SecuRing. He specializes in application security on Apple devices. He created the iOS Security Suite - an open-source anti-tampering framework. He is a Bugcrowd MVP that found vulnerabilities in Apple, Facebook, Malwarebytes, Slack, Atlassian, and others. \n\n In his free time, he runs an infosec blog - https://wojciechregula.blog and shared research on among others Black Hat (USA), Objective by the Sea (USA), AppSec Global (Israel), AppSec EU (United Kingdom), CONFidence (Poland), NULLCON (India).
Links:
Similar Presentations: