Apple's defense against apps vandalizing other apps still broken, developer claims
(2023/08/22)
- Reference: 1692692829
- News link: https://www.theregister.co.uk/2023/08/22/apple_macos_app_management/
- Source link:
Apple last year introduced a security feature called App Management that's designed to prevent one application from modifying another without authorization under macOS Ventura – but a developer claims it’s not very good at its job under some circumstances.
"If an app is modified by something that isn't signed by the same development team and isn't allowed by an NSUpdateSecurityPolicy , macOS will block the modification and notify the user that an app wants to manage other apps," explained Justin Sagurton of Apple’s privacy engineering team, in a [1]video presentation at the fruity computer seller's 2022 Worldwide Developers Conference.
Alas, this particular security mechanism – available to users via System Settings -> Security & Privacy -> App Management – appears not to manage app security very well.
[2]
Last October, Jeff Johnson, who develops software for various Apple platforms through his Underpass App Company, found that [3]sandboxed apps can bypass App Management.
A sandboxed app can modify a file that is supposed to be protected by App Management
The bug he found is similar to a bypass of Gatekeeper – a macOS feature designed to ensure that only trusted code can run on Apple computers – [4]identified by Microsoft researchers last year.
In a [5]blog post on Monday, Johnson describes how he was able to modify a Firefox settings file, update-settings.ini , in TextEdit, a macOS app, to change its behavior without triggering App Management intervention.
[6]
[7]
"TextEdit is sandboxed," he explains in his post. "Ironically, sandboxing was designed to prevent attacks, but in this case it allows an attack. That's the bug, the vulnerability. A sandboxed app can modify a file that is supposed to be protected by App Management."
But this isn't just about a file integrity risk posed by a local attacker. Johnson's proof-of-concept [8]exploit [ZIP] consists of a non-sandboxed app embedded within a sandboxed one. When downloaded from the internet, it prompts the user for a file path and then delegates file alteration to the embedded sandboxed app.
[9]
So the App Management hole could be used as part of an attack chain initiated through a downloaded malicious file.
[10]Apple demands app makers explain use of sensitive APIs
[11]Apple squashes kernel bug used by TriangleDB spyware
[12]Apple's latest security feature could literally save lives
[13]Apple pushes first-ever 'rapid' patch – and rapidly screws up
Johnson says he tested his proof-of-concept attack against macOS 13.5.1, [14]released five days ago , and it bypasses App Management, allowing any file in the app bundle (the main executable, a configuration file, or a license) to be altered. And the App Management system does not protest.
In a [15]preceding post , he says he reported the bug to Apple on October 19, 2022, and the iPhone giant acknowledged the bug report on October 21, 2022 – three days before the first general release of macOS Ventura (macOS 13), the most current supported release of Apple's desktop operating system.
More than 300 days later, Johnson says the bug remains unfixed, so he has decided to go public with it.
"Apple hasn't said anything about how serious they consider the issue to be, although perhaps their actions speak louder than words," Johnson told The Register in an email. "I did ask Apple Product Security to estimate the bounty payment, and they refused. In all communications with Apple Product Security, they refuse to say much, which makes them very frustrating to work with."
[16]
Apple's reluctance to communicate openly with the security community has been a longstanding point of contention among those who look for flaws in the tech giant's software and hardware, as underlined by the objections raised by researchers following the biz's ill-fated proposal in 2021 to [17]scan content on iDevices for illegal child abuse material.
Cupertino's silence about bugs prompted developer Tim Burks in 2008 to create [18]OpenRadar – a community bug-reporting site dedicated to showing programming blunders affecting Apple operating systems – because the outfit's own Radar bug-reporting system [19]is not available to the general public.
Apple did not respond to a request for comment, as is usually the case when contacted by The Register .
"I would say that my vulnerability renders App Management null and void," said Johnson. "The protection has never been effective. Apple shipped it with a gaping hole from day one. The vulnerability is quite trivial to exploit."
However, Johnson said that since App Management is a new addition to macOS Ventura, the current macOS is no more vulnerable than previous releases that didn't have the broken feature.
"That's why I don't feel too bad about publicly disclosing the vulnerability," he said. "My disclosure hasn't made Mac users worse off than before; it's simply the case that App Management never made Mac users better off than before. The new feature didn't work as advertised." ®
Get our [20]Tech Resources
[1] https://developer.apple.com/videos/play/wwdc2022/10096/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZOSHRBiFlqWPaxGQEJxIGAAAAws&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://developer.apple.com/documentation/security/app_sandbox
[4] https://www.theregister.com/2022/12/20/macos_gatekeeper_flaw_microsoft/
[5] https://lapcatsoftware.com/articles/2023/8/3.html
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZOSHRBiFlqWPaxGQEJxIGAAAAws&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZOSHRBiFlqWPaxGQEJxIGAAAAws&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://lapcatsoftware.com/articles/downloads/AppManagementBug.zip
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZOSHRBiFlqWPaxGQEJxIGAAAAws&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2023/07/29/apple_developer_api/
[11] https://www.theregister.com/2023/06/21/apple_patches_triangledb_spyware/
[12] https://www.theregister.com/2022/07/06/apple_lockdown_mode/
[13] https://www.theregister.com/2023/05/02/apple_rapid_patch/
[14] https://support.apple.com/en-us/HT201222
[15] https://lapcatsoftware.com/articles/2023/8/2.html
[16] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZOSHRBiFlqWPaxGQEJxIGAAAAws&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[17] https://www.theregister.com/2021/08/18/apples_csam_hashing/
[18] https://openradar.appspot.com/page/1
[19] https://openradar.appspot.com/faq
[20] https://whitepapers.theregister.com/
"If an app is modified by something that isn't signed by the same development team and isn't allowed by an NSUpdateSecurityPolicy , macOS will block the modification and notify the user that an app wants to manage other apps," explained Justin Sagurton of Apple’s privacy engineering team, in a [1]video presentation at the fruity computer seller's 2022 Worldwide Developers Conference.
Alas, this particular security mechanism – available to users via System Settings -> Security & Privacy -> App Management – appears not to manage app security very well.
[2]
Last October, Jeff Johnson, who develops software for various Apple platforms through his Underpass App Company, found that [3]sandboxed apps can bypass App Management.
A sandboxed app can modify a file that is supposed to be protected by App Management
The bug he found is similar to a bypass of Gatekeeper – a macOS feature designed to ensure that only trusted code can run on Apple computers – [4]identified by Microsoft researchers last year.
In a [5]blog post on Monday, Johnson describes how he was able to modify a Firefox settings file, update-settings.ini , in TextEdit, a macOS app, to change its behavior without triggering App Management intervention.
[6]
[7]
"TextEdit is sandboxed," he explains in his post. "Ironically, sandboxing was designed to prevent attacks, but in this case it allows an attack. That's the bug, the vulnerability. A sandboxed app can modify a file that is supposed to be protected by App Management."
But this isn't just about a file integrity risk posed by a local attacker. Johnson's proof-of-concept [8]exploit [ZIP] consists of a non-sandboxed app embedded within a sandboxed one. When downloaded from the internet, it prompts the user for a file path and then delegates file alteration to the embedded sandboxed app.
[9]
So the App Management hole could be used as part of an attack chain initiated through a downloaded malicious file.
[10]Apple demands app makers explain use of sensitive APIs
[11]Apple squashes kernel bug used by TriangleDB spyware
[12]Apple's latest security feature could literally save lives
[13]Apple pushes first-ever 'rapid' patch – and rapidly screws up
Johnson says he tested his proof-of-concept attack against macOS 13.5.1, [14]released five days ago , and it bypasses App Management, allowing any file in the app bundle (the main executable, a configuration file, or a license) to be altered. And the App Management system does not protest.
In a [15]preceding post , he says he reported the bug to Apple on October 19, 2022, and the iPhone giant acknowledged the bug report on October 21, 2022 – three days before the first general release of macOS Ventura (macOS 13), the most current supported release of Apple's desktop operating system.
More than 300 days later, Johnson says the bug remains unfixed, so he has decided to go public with it.
"Apple hasn't said anything about how serious they consider the issue to be, although perhaps their actions speak louder than words," Johnson told The Register in an email. "I did ask Apple Product Security to estimate the bounty payment, and they refused. In all communications with Apple Product Security, they refuse to say much, which makes them very frustrating to work with."
[16]
Apple's reluctance to communicate openly with the security community has been a longstanding point of contention among those who look for flaws in the tech giant's software and hardware, as underlined by the objections raised by researchers following the biz's ill-fated proposal in 2021 to [17]scan content on iDevices for illegal child abuse material.
Cupertino's silence about bugs prompted developer Tim Burks in 2008 to create [18]OpenRadar – a community bug-reporting site dedicated to showing programming blunders affecting Apple operating systems – because the outfit's own Radar bug-reporting system [19]is not available to the general public.
Apple did not respond to a request for comment, as is usually the case when contacted by The Register .
"I would say that my vulnerability renders App Management null and void," said Johnson. "The protection has never been effective. Apple shipped it with a gaping hole from day one. The vulnerability is quite trivial to exploit."
However, Johnson said that since App Management is a new addition to macOS Ventura, the current macOS is no more vulnerable than previous releases that didn't have the broken feature.
"That's why I don't feel too bad about publicly disclosing the vulnerability," he said. "My disclosure hasn't made Mac users worse off than before; it's simply the case that App Management never made Mac users better off than before. The new feature didn't work as advertised." ®
Get our [20]Tech Resources
[1] https://developer.apple.com/videos/play/wwdc2022/10096/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZOSHRBiFlqWPaxGQEJxIGAAAAws&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://developer.apple.com/documentation/security/app_sandbox
[4] https://www.theregister.com/2022/12/20/macos_gatekeeper_flaw_microsoft/
[5] https://lapcatsoftware.com/articles/2023/8/3.html
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZOSHRBiFlqWPaxGQEJxIGAAAAws&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZOSHRBiFlqWPaxGQEJxIGAAAAws&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://lapcatsoftware.com/articles/downloads/AppManagementBug.zip
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZOSHRBiFlqWPaxGQEJxIGAAAAws&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2023/07/29/apple_developer_api/
[11] https://www.theregister.com/2023/06/21/apple_patches_triangledb_spyware/
[12] https://www.theregister.com/2022/07/06/apple_lockdown_mode/
[13] https://www.theregister.com/2023/05/02/apple_rapid_patch/
[14] https://support.apple.com/en-us/HT201222
[15] https://lapcatsoftware.com/articles/2023/8/2.html
[16] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/research&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZOSHRBiFlqWPaxGQEJxIGAAAAws&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[17] https://www.theregister.com/2021/08/18/apples_csam_hashing/
[18] https://openradar.appspot.com/page/1
[19] https://openradar.appspot.com/faq
[20] https://whitepapers.theregister.com/
Anonymous Coward
Can someone ELI5 this for me, I'm a bit confused.
Do apps on MacOS get installed in user space or something?
On Linux an app cannot mess with another app unless I run it as root or something or unless I have installed the app in a user level context (e.g. a SNAP).
This all sounds like a filesystem level thing to me.
Spazturtle
"Do apps on MacOS get installed in user space or something"
Apps are just uncompressed zips that to install you just drag and drop into your Apps folder.
From what I can tell Apple's security stops apps from directly changing other apps without user input, but it doesn't stop the file picker from selecting other apps files, so you can open TextEdit and open the settings file for another app, make changes and then save them.
Not sure I get it
A text editor being used to edit a text file is a vulnerability? I use Sublime Text, and it will allow me to edit any file, prompting for authentication if I don't have write permissions.
What I don't like is the way Skype for Business (I have a client who can only use that for web meetings!) changed the settings in FaceTime so that any calls I tried to make (including when handing off to my iPhone) were routed to Skype - and I wasn't asked by the installer if I wanted to make Skype the default.
I agree that API changes to another apps settings and the direct manipulation of another app's files should not be allowed without use approval, so I guess that's what this is really about?