OS X Gatekeeper Bypass Vulnerability Amplia Security - Amplia Security Research Advisory (AMPLIA-ARA100614) Advisory ID: AMPLIA-ARA100614 Advisory URL: https://www.ampliasecurity.com/advisories/os-x-gatekeeper-bypass-vulnerability.html, https://www.ampliasecurity.com/advisories/AMPLIA-ARA100614.txt Date Published: 01-07-2015 Vendors Contacted: Apple (www.apple.com) (notified 10-06-2014) Release Mode: Coordinated Release Last Updated: 01-27-2105 Index ----- 1. Vulnerability Information 2. Vulnerability Description 3. Vulnerable Systems 4. Vendor Information, solutions and workarounds 5. Credits 6. Technical Description 7. Disclaimer 1.Vulnerability Information --------------------------- Impact: A malicious Jar file can bypass all OS X Gatekeeper warnings and protections, allowing a remote attacker to execute arbitrary unsigned code downloaded by the user. Java must be installed on the victim's machine. Remotely Exploitable: Yes Bugtraid ID: CVE ID: CVE-2014-8826 2.Vulnerability Description ---------------------------- Gatekeeper is a feature available in OS X Lion v10.7.5 and later versions of OS X. Gatekeeper performs checks on files and applications downloaded from the Internet to prevent execution of supposedly malicious and untrusted/unsigned code. Gatekeeper provides three different settings: - Mac App Store (Only apps that came from the Mac App Store can open) - Mac App Store and identified developers (Only apps that came from the Mac App Store and identified developers using Gatekeeper can open) - Anywhere The default setting is "Mac App Store and identified developers". This setting prevents execution of any code that was not downloaded from the Mac App Store and that was not digitally signed by a Developer ID registered with Apple. For example, If the user downloads an unsigned application from an untrusted source and double-clicks on the application to execute it, OS X Gatekeeper will prevent its execution with the following warning message: " can't be opened because it is from an unidentified developer." (For more information on OS X Gatekeeper, see https://support.apple.com/kb/ht5290) We found an attacker can bypass OS X Gatekeeper protections and execute unsigned malicious code downloaded by the user, even if OS X Gatekeeper is configured to only allow execution of applications downloaded from the Mac App Store (the highest security setting). The exploitation technique is trivial and requires Java to be installed on the victim's machine. OS X Gatekeeper prevents execution of downloaded Java Jar (.jar) and class (.class) files, but this verification can be bypassed. 3.Vulnerable Systems -------------------- Successful exploitation of this vulnerability requires Java to be installed on the target system. This vulnerability was successfully tested on the following versions of OS X: OS X Lion OS X Mavericks OS X Yosemite According to Apple, OS X Mountain Lion v10.8.5 is also vulnerable. All systems with OS X Gatekeeper are suspected to be vulnerable. 4.Vendor Information, Solutions and Workarounds ----------------------------------------------- Apple security updates are available via the Software Update mechanism: https://support.apple.com/kb/HT1338 Apple security updates are also available for manual download via: https://www.apple.com/support/downloads/ The security update is available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 and v10.10.1. The security update is not available for OS X Lion v10.7.5 which is also vulnerable to this issue. For more information see https://support.apple.com/kb/HT1222 5.Credits --------- This vulnerability was discovered by Hernan Ochoa from Amplia Security. 6. Technical Description ------------------------ Gatekeeper is a feature available in OS X Lion v10.7.5 and later versions of OS X. Gatekeeper performs checks on files and applications downloaded from the Internet to prevent execution of supposedly malicious and untrusted/unsigned code. Gatekeeper provides three different settings: - Mac App Store (Only apps that came from the Mac App Store can open) - Mac App Store and identified developers (Only apps that came from the Mac App Store and identified developers using Gatekeeper can open) - Anywhere The default setting is "Mac App Store and identified developers". This setting prevents execution of any code that was not downloaded from the Mac App Store and that was not digitally signed by a Developer ID registered with Apple. For example, If the user downloads an application from an untrusted source and double-clicks on the application to execute it, OS X Gatekeeper will prevent its execution with the following warning message: " can't be opened because it is from an unidentified developer." (For more information on OS X Gatekeeper, see https://support.apple.com/kb/ht5290) We found an attacker can bypass OS X Gatekeeper protections and execute unsigned malicious code downloaded by the user, even if OS X Gatekeeper is configured to only allow execution of applications downloaded from the Mac App Store (the highest security setting). The exploitation technique is trivial and requires Java to be installed on the victim's machine. OS X Gatekeeper prevents execution of downloaded Java Jar (.jar) and class (.class) files, but this verification can be bypassed. For example: - Create a JAR file containing the code to be executed For example, File AmpliaTest.java: public class AmpliaTest { public static void main(String[] args) { try { Runtime.getRuntime().exec("/usr/bin/touch /tmp/AMPLIASECURITY"); } catch(Exception e) { } } } (This is just an example, of course, arbitrary code can be executed) $ javac AmpliaTest.java Be sure to compile the code for a version of Java lower than or equal to the one available on the target (for example, javac -target 1.6 -source 1.6 AmpliaTest.java; and the compiled code will work on Java versions >= 1.6) . $ echo "main-class: AmpliaTest" > Manifest $ jar cmf Manifest UnsignedCode.jar AmpliaTest.class - Create a .DMG disk image For example: $ hdiutil create -size 5m -fs HFS+ -volname AmpliaSecurity AmpliaTest.dmg - Mount AmpliaTest.dmg - Rename UnsignedCode.jar to UnsignedCode (just remove the extension) - Copy UnsignedCode to the AmpliaSecurity volume - Unmount AmpliaTest.dmg - Host the file AmpliaTest.dmg on a web server - Download AmpliaTest.dmg using Safari and open it - Double-Click on 'UnsignedCode' and the code will be executed bypassing OS X Gatekeeper checks (the code creates the file /tmp/AMPLIASECURITY). (Perform the same steps but without removing the .jar extension to UnsignedCode.jar and OS X Gatekeeper will prevent execution of the Jar file) Because the file 'UnsignedCode' has no extension, Finder will display a blank page icon; the Java/JAR icon will not be displayed. The user does not know he is double-clicking on a JAR file and the file does not look particularly suspicious. Also, since the unsigned code is distributed inside a disk image (.DMG) file, there are many things the attacker can do to gain the trust of the user (include other files, use Finder background images, etc). Distribution of applications in .DMG files is common. Apple even distributes security patches using .DMG files. There are other attack scenarios. 7.Disclaimer ------------ The contents of this advisory are copyright (c) 2014,2015 Amplia Security (www.ampliasecurity.com), and may be distributed freely provided that no fee is charged for distribution and proper credit is given.