All Your Macs Are Belong To Us

The talk opens with the macOS security stack, covering file quarantine, Gatekeeper, notarization, XProtect and TCC, and explains why Gatekeeper is the main obstacle for red teams. The speakers then describe CVE-2021-30657, found by Cedric Owens. A bare app bundle with a script as its main executable and no Info.plist file could be launched with a double-click, skipping the usual checks. Apple fixed the issue within days in Big Sur 11.3 and Catalina.

Patrick Wardle traces the root cause. By comparing system logs from three unsigned test apps, he narrowed the problem to sysPolicyd, the policy daemon. Reversing its closed-source binary showed that a bundle-classification routine treated a script-based app without Info.plist as not being a bundle. Gatekeeper then returned an evaluation type that allowed execution. Jaron Bradley explains how Jamf Protect built a behavioral detection for this pattern. That detection caught the Shlayer adware family abusing the flaw as a zero-day, and the authors rapidly altered their samples after XProtect added a signature.

Wardle also presents a prevention approach. It uses Endpoint Security to hold new process launches that were translocated from the internet and are not notarized, and he implemented it in his open-source BlockBlock tool. Finally, diffing the unpatched and patched sysPolicyd showed that Apple added checks for a .app extension and a Contents/MacOS directory. The takeaway is that macOS policy code contained shallow logic bugs that had gone unaudited.