Infosec chap: I found a way to hijack your web accounts, turn on your webcam from Safari – and Apple gave me $100k
(2022/01/26)
- Reference: 1643185933
- News link: https://www.theregister.co.uk/2022/01/26/apple_filesharing_exploit/
- Source link:
A security bod scored a $100,500 bug bounty from Apple after discovering a vulnerability in Safari on macOS that could have been exploited by a malicious website to potentially access victims' logged-in online accounts – and even their webcams.
Ryan Pickren, last seen on The Register after [1]scooping $75k from Cupertino's coffers for finding an earlier webcam-snooping flaw, said the universal cross-site scripting (UXSS) bug in Safari could have been abused by a webpage to hijack a web account the user is logged into, which would be bad. It was also possible to activate the webcam.
Pickren told El Reg the flaw granted "full access to every website you've visited in Safari, meaning that if you're visiting my evil website on one tab, and then your other tab, you have Twitter open, I can jump into that tab and do everything you can from that screen. So it does allow me to fully perform an account takeover on every website you visited in Safari."
[2]
This attack is a bit of a wild ride, so strap in, and suffice to say: Apple has now patched the underlying vulnerability.
[3]
[4]
It involves webarchive files, which Safari generates when saving a copy of a webpage, and custom URI schemes that launch apps – think irc:, mailto:, chrome:, s3: and so on. There's [5]a list of them compiled by the Internet Assigned Numbers Authority.
[6]Flaw hunter bags $75,000 off Apple after duping Safari into spying through iPhone, Mac cameras without permission
[7]Why, yes, you can register an XSS attack as a UK company name. How do we know that? Someone actually did it
[8]We regret to inform you there's an RCE vuln in old version of WinRAR. Yes, the file decompression utility
[9]Apple patches 'actively exploited' iPhone zero-day with iOS 15.0.2 update
Non-standard URI schemes, when opened in Safari, trigger a warning dialog box before loading an external app to handle the request, Pickren said. That said, there's a list of trusted schemes hardcoded in Safari that open automatically without a prompt when requested. One of these schemes is icloud-sharing: , which fires up the operating system's internal ShareBear app to share a document via iCloud. A webpage that requests an icloud-sharing: link in Safari causes ShareBear to fire up to fetch the remote content.
"ShareBear was interesting to me because sharing iCloud documents seemed like a plausible path towards downloading and launching webarchive files," continued Pickren in [10]a write-up on his website about the vulnerability.
When ShareBear goes to fetch the requested content, and it's the first time it's done so for this file, it asks the user to accept the file. If the user accepts and downloads the document, whoever created the shared document can later change the content of the file on their Mac, and ShareBear will automatically change the file on the victim's machine.
[11]
So a webpage could offer an innocent-looking PNG, which the victim accepts and saves to disk. The owner of the file could then change it to a webarchive file, including the type, which is sync'd to the victim's machine, and launch it via a webpage visited by the victim. Pickren summarized this critical problem thus:
In essence, the victim has given the attacker permission to plant a polymorphic file onto their machine and the permission to remotely launch it at any moment. Yikes. Agreed to view my PNG file yesterday? Well today it's an executable binary that will be automatically launched whenever I want.
Pickren focused on opening a webarchive file on the victim's machine because macOS's Gatekeeper strives to block unapproved apps from running and downloaded webarchive files from opening – and it seemed easier to bypass the webarchive restriction. Doing just that was as simple as using a .url file, along with a .dmg file trick to ensure the malicious webarchive is stored in a known location – the /Volume folder.
Finally, when the malicious webarchive is launched by the attacker's webpage, it can run JavaScript in an arbitrary attacker-chosen origin, such as twitter.com or google.com, and this code can do whatever the user can do in that context. This means the webcam can be switched on in a trusted video chat context, such as facetime.apple.com.
Apple addressed these bugs in two parts, Pickren said. One, macOS Monterey 12.0.1 was released with ShareBear updated to just reveal downloaded files rather than launching them; and two, patching a bug designated CVE-2021-30861 in Safari's engine WebKit to stop quarantined files – such as downloaded webarchives – from being opened.
For finding and reporting this security hole in mid-2021, and related vulnerabilities, Pickren was awarded a $100,500 (£74,000) bounty, he said.
[12]
If someone at Apple would like to comment, you know where to find us. ®
Get our [13]Tech Resources
[1] https://www.theregister.com/2020/04/07/apple_safari_camera_hack/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YfEp2WDCCe8oCL74TTUUFwAAAFY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YfEp2WDCCe8oCL74TTUUFwAAAFY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YfEp2WDCCe8oCL74TTUUFwAAAFY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml
[6] https://www.theregister.com/2020/04/07/apple_safari_camera_hack/
[7] https://www.theregister.com/2020/10/30/companies_house_xss_silliness/
[8] https://www.theregister.com/2021/10/21/winrar_rce_vuln_positive_technologies/
[9] https://www.theregister.com/2021/10/12/apple_ios_15_0_2_zero_day_patched/
[10] https://www.ryanpickren.com/safari-uxss
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YfEp2WDCCe8oCL74TTUUFwAAAFY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YfEp2WDCCe8oCL74TTUUFwAAAFY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://whitepapers.theregister.com/
Ryan Pickren, last seen on The Register after [1]scooping $75k from Cupertino's coffers for finding an earlier webcam-snooping flaw, said the universal cross-site scripting (UXSS) bug in Safari could have been abused by a webpage to hijack a web account the user is logged into, which would be bad. It was also possible to activate the webcam.
Pickren told El Reg the flaw granted "full access to every website you've visited in Safari, meaning that if you're visiting my evil website on one tab, and then your other tab, you have Twitter open, I can jump into that tab and do everything you can from that screen. So it does allow me to fully perform an account takeover on every website you visited in Safari."
[2]
This attack is a bit of a wild ride, so strap in, and suffice to say: Apple has now patched the underlying vulnerability.
[3]
[4]
It involves webarchive files, which Safari generates when saving a copy of a webpage, and custom URI schemes that launch apps – think irc:, mailto:, chrome:, s3: and so on. There's [5]a list of them compiled by the Internet Assigned Numbers Authority.
[6]Flaw hunter bags $75,000 off Apple after duping Safari into spying through iPhone, Mac cameras without permission
[7]Why, yes, you can register an XSS attack as a UK company name. How do we know that? Someone actually did it
[8]We regret to inform you there's an RCE vuln in old version of WinRAR. Yes, the file decompression utility
[9]Apple patches 'actively exploited' iPhone zero-day with iOS 15.0.2 update
Non-standard URI schemes, when opened in Safari, trigger a warning dialog box before loading an external app to handle the request, Pickren said. That said, there's a list of trusted schemes hardcoded in Safari that open automatically without a prompt when requested. One of these schemes is icloud-sharing: , which fires up the operating system's internal ShareBear app to share a document via iCloud. A webpage that requests an icloud-sharing: link in Safari causes ShareBear to fire up to fetch the remote content.
"ShareBear was interesting to me because sharing iCloud documents seemed like a plausible path towards downloading and launching webarchive files," continued Pickren in [10]a write-up on his website about the vulnerability.
When ShareBear goes to fetch the requested content, and it's the first time it's done so for this file, it asks the user to accept the file. If the user accepts and downloads the document, whoever created the shared document can later change the content of the file on their Mac, and ShareBear will automatically change the file on the victim's machine.
[11]
So a webpage could offer an innocent-looking PNG, which the victim accepts and saves to disk. The owner of the file could then change it to a webarchive file, including the type, which is sync'd to the victim's machine, and launch it via a webpage visited by the victim. Pickren summarized this critical problem thus:
In essence, the victim has given the attacker permission to plant a polymorphic file onto their machine and the permission to remotely launch it at any moment. Yikes. Agreed to view my PNG file yesterday? Well today it's an executable binary that will be automatically launched whenever I want.
Pickren focused on opening a webarchive file on the victim's machine because macOS's Gatekeeper strives to block unapproved apps from running and downloaded webarchive files from opening – and it seemed easier to bypass the webarchive restriction. Doing just that was as simple as using a .url file, along with a .dmg file trick to ensure the malicious webarchive is stored in a known location – the /Volume folder.
Finally, when the malicious webarchive is launched by the attacker's webpage, it can run JavaScript in an arbitrary attacker-chosen origin, such as twitter.com or google.com, and this code can do whatever the user can do in that context. This means the webcam can be switched on in a trusted video chat context, such as facetime.apple.com.
Apple addressed these bugs in two parts, Pickren said. One, macOS Monterey 12.0.1 was released with ShareBear updated to just reveal downloaded files rather than launching them; and two, patching a bug designated CVE-2021-30861 in Safari's engine WebKit to stop quarantined files – such as downloaded webarchives – from being opened.
For finding and reporting this security hole in mid-2021, and related vulnerabilities, Pickren was awarded a $100,500 (£74,000) bounty, he said.
[12]
If someone at Apple would like to comment, you know where to find us. ®
Get our [13]Tech Resources
[1] https://www.theregister.com/2020/04/07/apple_safari_camera_hack/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YfEp2WDCCe8oCL74TTUUFwAAAFY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YfEp2WDCCe8oCL74TTUUFwAAAFY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YfEp2WDCCe8oCL74TTUUFwAAAFY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml
[6] https://www.theregister.com/2020/04/07/apple_safari_camera_hack/
[7] https://www.theregister.com/2020/10/30/companies_house_xss_silliness/
[8] https://www.theregister.com/2021/10/21/winrar_rce_vuln_positive_technologies/
[9] https://www.theregister.com/2021/10/12/apple_ios_15_0_2_zero_day_patched/
[10] https://www.ryanpickren.com/safari-uxss
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YfEp2WDCCe8oCL74TTUUFwAAAFY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YfEp2WDCCe8oCL74TTUUFwAAAFY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[13] https://whitepapers.theregister.com/
Value for money
Pete 2
> A security bod scored a $100,500 bug bounty from Apple
And that's still cheaper than testing stuff before it escapes it is released.
Re: Value for money
veti
But the bug has been patched. The development, testing and rollout of the patch will have cost way more than the bounty.
There is no such thing as perfect testing, and vulnerabilities will always get through.
Re: Value for money
AMBxx
From the article, this sounds more like really bad design rather than a bug. Testing wouldn't have really helped as it was doing what it was designed to do. Sounds like they need to change their approach to development.
Apple: It just works
Natalie Gritpants Jr
Including the vulnerabilities.
Re: Apple: It just works
Wyrdness
Not unique to Apple. There's also a story on El Reg today about a Linux bug that can grant root access.
https://www.theregister.com/2022/01/26/pwnkit_vulnerability_linuix/
Re: Apple: It just works
AMBxx
Yay to Windows!!
Not holding my breath
“ If someone at Apple would like to comment, you know where to find us.”