<story><title>Breaking all macOS security layers with a single vulnerability</title><url>https://sector7.computest.nl/post/2022-08-process-injection-breaking-all-macos-security-layers-with-a-single-vulnerability/</url></story><parent_chain><item><author>blinkingled</author><text>&amp;gt;Changing a security model that has been used for decades to a more restrictive model is difficult, especially in something as complicated as macOS. Attaching debuggers is just one example, there are many similar techniques that could be used to inject code into a different process. Apple has squashed many of these techniques, but many other ones are likely still undiscovered.&lt;p&gt;&amp;gt; Aside from Apple’s own code, these vulnerabilities could also occur in third-party software. It’s quite common to find a process injection vulnerability in a specific application, which means that the permissions (TCC permissions and entitlements) of that application are up for grabs for all other processes. Getting those fixed is a difficult process, because many third-party developers are not familiar with this new security model. Reporting these vulnerabilities often requires fully explaining this new model! Especially Electron applications are infamous for being easy to inject into, as it is possible to replace their JavaScript files without invalidating the code signature.&lt;p&gt;It makes me sad that we are likely not going to see any new fundamental design rethink for security&amp;#x27;s sake in mainstream operating systems. It is cost prohibitive at this point to do something that gets security right for the world of 2022 and yet not break all the apps which would never be rewritten!&lt;p&gt;Mobile OSes were a good break off point as far as security goes but that came with a lot of functionality sacrifice.&lt;p&gt;Although something like QubesOS can theoretically dream of being semi-mainstream with support from hardware and OSS OS vendors like RH&amp;#x2F;Suse&amp;#x2F;Canonical or even Microsoft.</text></item></parent_chain><comment><author>userbinator</author><text>&lt;i&gt;It makes me sad that we are likely not going to see any new fundamental design rethink for security&amp;#x27;s sake in mainstream operating systems.&lt;/i&gt;&lt;p&gt;Contrarily, that makes me happy because if that happens we are really going to lose what little computing freedom we have left, as it will only make the walled garden silos even stronger.</text></comment>
<story><title>Breaking all macOS security layers with a single vulnerability</title><url>https://sector7.computest.nl/post/2022-08-process-injection-breaking-all-macos-security-layers-with-a-single-vulnerability/</url></story><parent_chain><item><author>blinkingled</author><text>&amp;gt;Changing a security model that has been used for decades to a more restrictive model is difficult, especially in something as complicated as macOS. Attaching debuggers is just one example, there are many similar techniques that could be used to inject code into a different process. Apple has squashed many of these techniques, but many other ones are likely still undiscovered.&lt;p&gt;&amp;gt; Aside from Apple’s own code, these vulnerabilities could also occur in third-party software. It’s quite common to find a process injection vulnerability in a specific application, which means that the permissions (TCC permissions and entitlements) of that application are up for grabs for all other processes. Getting those fixed is a difficult process, because many third-party developers are not familiar with this new security model. Reporting these vulnerabilities often requires fully explaining this new model! Especially Electron applications are infamous for being easy to inject into, as it is possible to replace their JavaScript files without invalidating the code signature.&lt;p&gt;It makes me sad that we are likely not going to see any new fundamental design rethink for security&amp;#x27;s sake in mainstream operating systems. It is cost prohibitive at this point to do something that gets security right for the world of 2022 and yet not break all the apps which would never be rewritten!&lt;p&gt;Mobile OSes were a good break off point as far as security goes but that came with a lot of functionality sacrifice.&lt;p&gt;Although something like QubesOS can theoretically dream of being semi-mainstream with support from hardware and OSS OS vendors like RH&amp;#x2F;Suse&amp;#x2F;Canonical or even Microsoft.</text></item></parent_chain><comment><author>olliej</author><text>Fuchsia does a pure capability model, and resources, even as basic as the file system are provided through handles - and your file system handle is a handle to what would be a directory elsewhere, but that is the entire file system so it’s not a matter of finding a traversal exploit.&lt;p&gt;In principle you could do something similar with the Mac&amp;#x2F;iOS sandbox by starting a process with a compute only sandbox, and then provide it with specific sandbox entitlements (from the parent) which includes specific file systems, however they still in principle can see a full version of the fs.&lt;p&gt;And yeah, any OS that isn’t completely new is burdened with support for old apps, but then iOS which used its newness to have a stronger base security model is constantly beaten up for that model.</text></comment>