Hey Hackers! 👋🏻 In this blog post, I want to show you why signing applications with get-task-allow entitlement may be dangerous and can lead to local privilege escalation bugs. We are going to exploit a real application, iExplorer, that is widely used by iOS application pentesters. Make a notice that iExplorer is only an example - a lot of apps have that excessive entitlement set. Entitlements? Since Mac OS X 10.
Readers who know me, probably also know that I like test soft that I use. So it was this time. I wanted to collect all my chaotically stored notes in Apple Notes, docx files, txts etc. I considered many different noting apps but finally I chose Bear.app. Bear offers cool hashtags systems, markdown notation and syntax highlighting that totally bought me. 😉 Bear is also in top 10 App Store productivity apps!
Before I start describing details you have to know that this post is published on Responsible Disclosure terms. I sent full report with all the findings to DASAN on 24th October 2017. We have been talking about these vulnerabilities for a long time and one day they just stopped contacting me anymore (even when I warned them that I want to disclose this). Today is 26th April 2018, so it’s over half year after DASAN has been informed.
Not so long time ago I submitted my presentation proposal on CONFidence’s Call For Papers. CONFidence is one of the best European IT Sec conference that I love to attend due to very good presentations quality and hackish^H^H atmosphere ;-) This year I decided to actively attend as a speaker with my presentation about pentesting iOS apps using jailed iDevice. I sent my proposal and when I received the approval, I visited the conference’s website in order to check if I’m included in the speakers list for sure (in SecuRing it’s common to prank your colleagues like for instance sending emails from fake server, haha).
It’s March 2018 when I’m writing this post. From day to day, Apple’s security is improved - we have Kernel Patch Protection, Secure Enclave Processor (now even on macOS with Touch Bar), GateKeeper and many other security features. On the other hand, only in the last half of the year some trivial bugs were found that led to password disclosure. It’s seems like password leaks may be currently the most serious, from PR perspective, *OS problem.
What FreePlane is? FreePlane is an open-source application intended for creating mind maps. Vulnerability descripton: FreePlane is Java-based app that loads its mind maps that are stored as a simple XML files. The parser allowed to expand external entities that caused this vulnerability. Results: When victim opens maliciously crafted mind map, any accessible by Java file can be sent to the attacker. Proof of concept: Malicious mindmap: <map version="freeplane 1.