[Music]
as you probably noticed we all had some
spare time at our hands in the last two
years because most of travel and daily
commute fell away and
some of us started sewing cooking baking
bread or doing other hobbies and then
there were people that spent the time
slightly differently one of them is our
next speakers um so please give
and to hear what what he spent his last
two years on um here's a tourmill with
your my journey to find vulnerabilities
in mac os
all right thank you and it's great to
see that there's so many of you here in
the tent enjoying the warm weather and
thank you all for coming and especially
for you guys who are over there over
here and also thank you for the all the
who are watching the stream
uh first of all it's great to be here
i've been going to the old camp since
the 2011
and i really enjoyed this and it's great
to be on the stage in this day but first
of all i want to give another uh
big hand for the all the organizers and
angels and volunteers over here to
making this great event to actually
happen
[Applause]
all right so today i'm going to walk you
through some of my
hobby research what i've done
during the last two years
so my name is mikko kentala
also known as turmeo
and i'm one of a founder and ceo of
sensor foo we
built a cyber security solution to
continuously monitor uh how well your
network isolation is working but this is
not nothing related to that in in that
sense but this is more about my hobby
stuff
so
i've done some hobby research related to
the mac os before
i found on critical vulnerability
related to the mac os mile application
application before which basically
provided an attacker
uh to access to change the mile
application configuration via email so
only thing what you needed to do was to
send an email to the victim and it will
exploit the vulnerability and change the
configuration in your mile application
you can see and find out all the details
from my blog
and this is uh
uh something what i've done before but
today i'm going to talk about a little
bit different uh vulnerability
chain and go through all the parts
related to that chain and and just to
make uh
make sure that you know what you have
been coming to watch i want to show the
demonstration immediately at first so
you can decide that if you want to see
and learn all the details what's
happening under the hood
so i this is actually the same video
what i sent to the apple so i just want
to show you that the
this was the beta version of the picture
back then and showing that the oops
let's try it again
so
so you can see that it's the uh mac os
pixer and
it has all the security mechanisms
mechanisms enabled so the zip protection
is enabled i will explain this later on
what it means
and if you try even in your terminal if
you try to read your desktop you cannot
do it because it's it's
protected by other security and
mechanisms so
let's say the user is tricked to
download something in this case
it's a zip file
and now the zip file is downloaded
and it will take a while
and that was the one click related that
you need to allow the download to
actually happen
and now when the user next time launches
the terminal
something went wrong and you can see
that the machine is infected and you can
see that now the terminal was able to
read all the files on the desktop and so
on
so
this
basically
was the chain
of vulnerabilities related to the
different security mechanisms i'm going
to walk you through that what's
happening under the hood
so but first of first of all a little
bit background and how i normally find
some vulnerabilities i'm really into
a
logic box so i enjoy finding those the
most and because
i find those also somewhat funny because
i'm just using some of the features
which might be over there and maybe
using those
uh to be clever enough to cause some
confusion from the security point of
view so i operate always with this
method method uh i have a
uh over 10 years of
experience of doing different type of
technical security audits and i've used
this basically since the beginning so at
first learn as much as possible from the
target what you are testing or where you
try to find out the vulnerabilities read
the documentation but especially do the
reverse engineering because many times
you find hidden
options or hidden services or hidden
functions from the application what you
are testing and you get the different
kind of point of view compared to the
maybe the developer who has actually
done the software what you are testing
so that's really important especially
for me
and the goal is to know how exactly the
system what you are testing is working
i use tools to
trace the two scores when i run the
application i run d trace or something
like that to see that what's actually
happening in the operating system to
find out and learn what is actually
going on under the hood try to find the
anomaly so if you have a user input
somewhere put something to that try to
cause some troubles set
maybe add some extra characters add some
code do whatever try to cause some
malfunction in the application and that
might be it that might be the
vulnerability test if you can manipulate
it somehow the
operating system or the environment
where the application is running and
then try to exploit it pretty
straightforward but might take some time
to actually get it all the done
so in mac os if you want to achieve the
code execution and if especially if you
want to access the all the data in the
system you need to circumvent plenty of
different security mechanisms
and the uh so in this case we need to
exploit the initial vulnerability evade
the gatekeeper evade the tcc
and i will go that true in more details
later on and if i evade the zip
protection to access the tcc database
in nutshell this i could spend much more
time with this but the
gatekeeper in general if you are running
the mac os you see the uh
pop-ups especially if you are
downloading something from the internet
and you want to run it
applications and so on you see some
pop-ups which tries to prevent you to
actually running it and make this
gatekeeper also make sure that the
software is signed correctly and so on
from the known developer and so on so
it tries to prevent the
execution of potential malicious
binaries or applications in your system
tcc on the other hand is the mechanized
mechanism which is
taking care of the
all your most valuable data in your
system it can be your camera in your mac
it might be files and and other data
what you might have in your machine
calendar events may emails and so on so
tcc controls that what application can
actually access to some of the data so
it is providing the sandboxing
and the controlling the access controls
uh then there's a sip system integrity
protection which is actually in kernel
it is it is protecting the most valuable
files and the uh things related to the
operating system
so
and it's providing a
extra layer of protection so even if you
are administrator or root in the system
you cannot change some of the files
because this sip kernel model is
protecting
protecting that
okay so hopefully there was
you can remember some of that
so let's dive in to the actual topic
uh the
main thing related to this vulnerability
chain and this is how everything started
is related to the alias files in mac os
uh so when you saw the video and the
user downloaded the uh
zip file from the internet basically
that was the one click part so when when
the user
uh hits the potential download link or
when go to the web page which provides
the
zip file you will be prompted about that
do you want to do you really want to
download this file and this was the one
click related to this vulnerability what
user need to be
a user need to do
to actually be infected
so what's happening under the hood
when the zip file is downloaded
safari will actually automatically
uncompress the zip file this is because
apple and mac os considers that zip
files are so called save so you can
automatically because test setting what
you are most likely do anyway when you
download the zip files so you will
anyway uncompress it and that's what it
does automatically so i was starting
started to think that maybe i can
leverage this and i was
doing research before with the mile
application and
that was also handling the zip file so
this was kind of side track of that
vulnerability when i was researching
that
how i could get uh
some
analysis done
uh with one click or with zero click so
this was one track of it and this is
basically how the
application or the exploit chain starts
so the zip fly file actually includes an
application mac os application
and it
mac os applications are basically
directories including multiple files
there's a certain structure
but
including the main executable over there
and in my case
that executable was an alias file
so what the heck is mac os alias files
so
uh
that was actually that's something a
little bit different compared to the
linux and bsd
links or
windows
link files so mac os
has had an
alias system since
91 so this is 31 years old feature in
the mac os which is still over there and
this is a little bit different compared
to the other operating system so
basically those alias files are have
extra features
which can relate and point out to the
files in your file system and even if
you move those to different places the
alias will still work so it tracks
wherever the original file is but the
good option or the cool thing about the
alias files is that it can also point to
the external external resource so for
example samba mode or something like
that
and that exactly what is happening in
the first
first phase so when the when you when
the application is downloaded
it includes the main executable which is
actually
alias file which is pointing to the
external resource resource which is the
attacker samba server so when the alias
file is
automatically resolved by the lsd which
is one of the background processes in
mac os which is taking care of the
things like if you have a if you want
application which will be automatically
launched when you boot your mac it
checks out that kind of things
so
your mac os will find out that oh you
have a new application
lsd will go in index those files check
specific files like the main binary it
finds out that oh this is alias file so
it won't include any data but since it's
capable of triggering the mount it will
automatically trigger the samba mode and
now
attackers have a possibility to mount
their own data to the victim's machine
automatically
so what now attacker can trigger some
amount but what can you do with that and
that's a tricky
question so i try to play around
multiple things try to
find out if i can maybe fool the user or
find out automatic feature to launch
malicious binaries from that samba mount
but there was many obstacles like a
gatekeeper for example because
everything what i tried
uh gatekeeper was blocking those because
it was an external source and so on
so what can i do
i figure out that maybe i try to find
out the way to actually mount
the
samba mount completely different path
and this is important to know that when
you normally open any image or network
share in your mac
all the
modes will be done under these last
volumes
and the naming goes so that the after
the volumes you have a name for the
moment and that is taken from the last
path from the url
uh which is pointing to the samba mount
for example and that will be the name
for the directory
however i tried to do the most obvious
things uh try to do
dot slash and so on
but couldn't get anything like uh
valuable from the hacking point of view
to in place actually and none of the
tricks what i tried actually worked
except
there was one anomaly
so i was able to make the file naming
logic to fail from the
default one if i add then
percent
0 0 which is null at the end of the url
so something weird happened and instead
of normal logic the samba mount was
mounted with the in the way that you
have a slash volume and fully qualified
domain name of that samba share so
something definitely went wrong and i
started to figure think about that can i
leverage that somehow
and it turned out
that the
i i started to think that well
it's a little bit restrictive to
play around with the domains but then i
remember that well you can do wildcard
domain names so which basically points
always to the same ip address but you
can set anything you like to the uh
domain name and that should work so i
started to play around a bit more
and
this
did the trick
i don't know if you can see it hopefully
you can but i will walk it through step
by step
so first thing
uh
break the default naming method uh
to set the mousepad the default mount
path so that's the number one thing
which is at the end of that url that
percent 0 0
so now we are relying to the fully
qualified domain name so next one is to
use
double encoding for some reason to
follow some of the parsers so if you
use just a normal url encoding i guess
those won't be
though some some of the parsers didn't
accept that so i used double encoding to
cause it
to actually
and that way it will be encoded as an
dot dot slash and that was like a valid
from the point of view of samba mode so
that way i could do the same thing do
tests like uh dot dot slash private
slash temp slash test
and but then there was one problem which
is that you still have the rest of the
domain name which will be included to
the path the name of the path so for
that reason you need to add another null
character to actually terminate the
string what you want to use in your path
and with that way i was able to cause
the arbitrary mount path for that samba
mount so instead
of having it mounted to this last volume
slash stamp it would be
mounted slash volumes dot dot slash
private slash stamp slash test so it's
completely different directory then
okay so now i have a
possibility to mount
some amounts automatically to any
path what i want
but what to do next still no code
execution
how i can leverage this to actually
cause and code execution and in
history of exploitation in this part of
the exploit chain it shouldn't be too
hard to actually actually achieve it if
you are able to arbitrary uh mount some
external files to any path you want
it shouldn't be too hard however
it was quite hard mainly because there
was a couple of limitations so normal
way to leverage this is to actually use
some existing softwares in the system so
maybe
do a mount to path with it will which
will include plugins or another features
which will be automatically loaded
however i had a huge and this is
actually part of the
uh this i spent most of the time to
figuring out this even though it
shouldn't be too hard but it turned out
to be quite hard mainly because of the
fact that the last
speed pump over there that the mounting
mount point directory need to be new in
the system so all the existing softwares
which were in place where actually
all the folders and the paths were
actually already created so i couldn't
use those i needed to find out the way
to actually
create a new directory which will be
loaded
but even after that there was the
gatekeeper which was which was
preventing me to get the code execution
however there's always a way you just
need to sit on your laptop or computer
and figure it out
and the in this phase i
ended up using the jet sh configuration
file which is
uh zsh is the default shell in your
system if you are using the mac os and
it includes the configuration directory
related to the keyboard layouts and so
on which will be included every time
when the jet sh is initialized
so
i went to that path i mounted the
my samba mount including my special
configuration file for the jet sh to the
user's folder and whenever the user will
launch a terminal that will be
automatically included
and i have a code execution
so that was quite handy although it took
surprisingly long time to actually find
out and we need to remember that this is
not vulnerability this is just a feature
there's nothing to fix it it's working
as it should be this specific part so
this is not in that sense this was the
trivial obstacle
turned out to be a quite hard one to
actually solve
so now we have a code execution also but
what to do next
i cannot access any personal files and
since the sandboxing is working as it
should be all the most important user
files are still
in the protections of the other security
mechanisms
so what to do next
and the main target in this phase is the
tcc and the tcc was the one uh
transparent consent and control so the
thing what you use whenever you are
launching an application and allowing
them to access to your camera or
specific files or so on so this will
block quite a lot of things so
let's
we need to somehow circumvent the dcc to
actually find it out
so tcc actually works so that every user
has a tcc database in their own home
directory and a library in there
the tcc database is actually just sqlite
database and nothing fancy with that
including all the configuration what you
might do via graphical user interface
but it is also protected by the zip and
the zip is providing the protection to
that database in a way that you should
be only able to change the configuration
from the graphical user interface what
you saw beforehand on the previous slide
so that's that's the normal way to
actually
control that database but since that
includes heavily the user interaction
that was obviously problem for me
because i wanted to cause some automatic
uh changes in the system and within the
tcc database so we need to
find out the way to circumvent this sip
which is protecting the tcc database
so this sip is protecting specific file
in the system and it's built in the
kernel level so i needed to figure out
how to solve that
so uh dcc
is you tcc database is used by the
service called tccd
and the dccd process is owned by the
user
so since i have already access to run
arbitrary code in the system in as with
the user
user permissions i was thinking of that
there has to be a way to actually
manipulate the files
but to see because the sip is protecting
the dcc database
uh we needed to find out to do some
trick to fool all the
security measures around it
and turns out this did the trick so no
worries if you are not seeing it i will
walk it through that what's happening
over there
so
since
in the beginning uh
first we kill the process the eccd
to force it to load
all the environments and all the
everything related to that process again
immediately after that we mount a new
directory to the protected path from
from the image so we have an image which
includes
new
database uh the tcc database and we
mount that
image to that exact path
where the files normally are and where
the database are
already
so when the dc-cd process will start
it will automatically load the dcc
database
from the specific path but now that path
it it includes actually our payload and
our configuration will be loaded
so sip
is actually still protecting the
original files in the file systems but
the trick is that the
we instead of using those exact files
which are now protected by sip we
actually fool the tccd process to load
the my new files from the system and i
have to say this was completely lucky
strike this was
first thing what i tried when i got this
obstacle so i was thinking of how how
can i fool this this dc cd
uh to actually load some my database
first thing what came to my mind was
let's try to mount something to that
directory will it work and it worked and
i was stunted
this was it
really but uh
it doesn't necessarily mean that it was
poorly implemented but i got the lucky
strike because i was playing around
previously with the mount so obviously
that was the first thing to come to my
mind that what the heck let's try that
and it worked and i was like completely
surprised that this was it
so success
the puzzle was solved uh this was
now attacker can use mac os alias files
to cause one click network mount
to arbitrary directory which will lead
the remote or arbitrary code execution
with the user privileges and since we
can
after that we combine that with the
aviations related to the other security
mechanisms we can actually access all
the
users data and sensitive data in the mac
os
so it turned out that
this was a
i started as a
fun
let's play around a bit
and some something started to come up i
started to continue to play around a bit
more
and found the new things but after the
multiple steps the
puzzle was solved and the
uh also this would help the 100 million
mac os users in the world and
we we got it fixed in that way
so from the initial access user will
download the zip file
zip file will be automatically extracted
by safari lsd process will come in and
automatically index the new files which
are over there it will find out that
this alias interesting alias file and
will resolve that which will cause the
infection of the mac os and now you have
the malicious mount in your system
and whenever the user launches the
terminal it will trigger the arbitrary
code execution because it will load the
configuration and immediately do the
evasions for the security mechanism in
the mac os and that way can access all
the data in the user's environment and
do whatever what what the attacker wants
with that data uploading those
to third-party servers or so on
so
timeline i actually found this bug
in 2020
in the late over there and uh got the
discussion going on with the apple
reported about it
and got the discussions going on with
them
they had some troubles to reproduce the
issue because it includes the samba
server and
they
couldn't get it like done in a way how i
was configured it so i actually prepared
the virtual machine for them
uh to use it as a samba server to
actually make the full vulnerability
chained actually fixed or they test it
and later on those will those were fixed
in quite early phase
then it took quite a long time
and 2025 uh just in december the report
was qualified as an apple security
bounty so it took something like
a bit over one year to
figure out that if it's a
eligible for the bounty
just want to show you that this is how
it look like when they
when they
release the fixes and how it looks like
in the chains lock
so mounting malicious crafted samba
server network uh network share may lead
to arbitrary code execution and the back
in the time a couple of years ago
i think these
uh chains locks were actually not that
exact as they are in the current
currently and i'm really happy about
that
the second
vulnerability
it looks like this and it turned out
that there was a bug collision related
to this one however i did the
it seems so that i did the first one we
just discussed with the other
researchers about it and it seems so
that i found it first but anyway
there was a multiple researchers doing
research especially tcc and i guess we
have another talk coming today about
that also
so go and check that too
but there were there has been quite a
lot of issues related to the tcc and
quite a lot of vulnerabilities
so
hopefully it's better in future however
it includes the fundamental issue that
the you as an user you have a permission
to do the changes for that
and at the same time it so it means that
you get infected there might be multiple
ways to actually
uh exploit the
tcc database and it seems so at least so
far let's see how the
how the future will come
so it looks like that i'm uh i was quite
fast related to compared to the timing
what i was trying before
so at this moment i i want to thank you
all and take q a and and if you have
some questions later on i want to show
you that we are i'm from finland so we
are in the finnish village you can find
it right next to the sauna so come and
have a chat with me
and let's discuss more about this and
maybe have a sauna or salmiakki
together with us so thank you
[Music]
thank you very much tomio if you have
any questions please line up at the two
microphones we have here in the middle
of the room um yes i know it's hot and
you have to move unfortunately we can't
bring the mics to you
are there any questions in the audience
if there are take your time to get to
the microphone just indicate that you're
moving
i guess
don't don't tap on the mic just close to
the microphone and start talking that
should work can you hear me yes
i just had a simple question
will the slides be available
yes
those will be all right thanks
okay um
thanks for the great talk and the
uh awesome research so uh my question
maybe is uh because you have been
looking at uh these things for quite a
long time so uh what have you been doing
after 2020
let's see it might be that there will be
more dragons so let's see but
i do this as a hobby so
as you most likely all of your fellow
hackers know your attention goes to some
place something new always so there
might be some time also but let's see
uh if there's more coming related to the
mac os vulnerabilities
uh but in the meantime i've been also
doing other things sometimes even with
the family doing something so and i
wanted at this at this point i want to
thank the family and they
and you be patient with me when i was
finding this because those were quite
long day days and they needed to be
flexible also so thank you
hi uh yeah thanks for the talk actually
i have two questions um yes before you
start could you move closer to the mic
yes i can hear you i can try do it like
in heavy metal
i was quite surprised how
simple
in quotes uh this attack was it was
nothing like really what people might
imagine yeah what hacking is like it's
the simplest kinds of exploits that you
can think of yeah um
first question how was your experience
um actually in communicating
with apple about this
how did they react how were the reaction
times and stuff like that
so uh so i've reported multiple
vulnerabilities for them uh but the
let's say let's pick this email communic
email issue and this one
so the email was real email issue was
really straightforward because it was so
easy to reproduce and it was clear for
everybody that was going on this was a
bit more trickier i get the
they replied quite quickly and thanked
for it uh they were able to reproduce it
part of the issues
so that got also
fixed quite early on
but i needed to poke around a bit that
hey what's going on if there is still
some issues or because i didn't hear
about them
from after quite long time two months or
so and then they ask that okay we have a
hard time to reproduce this part related
to the samba mount
and i
recorded the video for them
and how it actually goes and
then
uh tried to help them to do the samba
server but then figured out what the
heck i just do the virtual machine and
because that's the easiest way and
that's way everything will be in place
and after that it went rather smoothly
although once again after because there
was no no no comments related to the
backbone there i started to ask around
that hey when when you are able to check
out the if this is a valid for the
backbone the or if they're what's what's
going to happen related to that and i
want to quickly comment since we have
some time to the uh
fact that these are rather trivial
bugs
but the
actually the original idea was that
because i i'm i'm using mac os myself i
follow the
security changes and follow what the
other researchers are doing and i've
been i started to think about that maybe
there's some
old things what we used to find out from
the unix systems back in the 10 years
ago maybe it seems that nobody is
fighting those kinds of parks so let's
see what's going on over there maybe
there's a similar kind of issues because
for me it looks like the security
community in general is working so that
there's a sauron's eye which is turning
to the some direction everybody is
hacking the same things and
or at least most of the not everybody
obviously but the most of the persons
are finding when there's a new
interesting thing everybody goes there
and start to figure out that maybe
there's uh some more vulnerabilities so
i started to think that i'm i'm not that
clever so maybe it's better that i look
to other direction and find out if
there's some leftovers from the 10 years
ago to find out and there was and the
that's also which
which is a little bit concerning for me
is that the how much there's there
actually is eyes for this kind of logic
box because it seems that there's plenty
of those on the field still to find out
so
uh even though we have a great ctf over
here so every now and then when you feel
that maybe we should do a ctf and
participate to some of those
competitions maybe it could it is good
idea to try to find out vulnerabilities
for mac os or any other operating
systems because there's a similar issues
what we have been seeing over the last
20 years or so in the unique system so
it might be worth to check out and there
might be some low hanging fruits
okay
thank you quick second question yep
since you exploited quite a chain of
vulnerabilities
you just found one possible way to
execute code by mounting your malicious
folder to the zsh zsh folder
so this means
on one hand the victim has to open that
terminal force this to become effective
yeah it also means that there might
potentially be other paths that would
automatically execute code
without the user having to do anything
yeah this is quite concerning i think
even more yes absolutely and
i was
heavily considering to do more research
on that to cause it like a trigger
different way
but
i decided that because this is not the
part where the actual
vulnerability is it's kind of irrelevant
because because after all the initial
vector is the vulnerability and how i
exploit the other security measures
later on are those vulnerabilities i
decided that this is good enough for the
proof of concept there should be other
options i was able to do a couple of
things also which were like something to
maybe do research more in the future but
the but yeah there's plenty of speed
bumps and obstacles so whatever in work
for me in this case because this is not
the core part of the vulnerability
thanks thanks
any further questions
i think everyone's everyone wants to go
for a swim well
if there are no further questions i
would like to ask you give another very
cool round of applause to tormeo
thank you very much
[Music]