Mac OS hacX Things you need to know about your Mac Alessio L.R. - - PowerPoint PPT Presentation

▶
mac os hacx
SMART_READER_LITE
LIVE PREVIEW

Mac OS hacX Things you need to know about your Mac Alessio L.R. - - PowerPoint PPT Presentation

Aug 23, 2022 253 likes •1.11k views

Mac OS hacX Things you need to know about your Mac Alessio L.R. Pennasilico mayhem@alba.st Pescara, 22 Agosto 2008 $ whois mayhem Security Evangelist @ Member / Board of Directors: AIP, AIPSI/ISSA, CLUSIT, Italian Linux Society, IT-ISAC,

slide-1
SLIDE 1

Alessio L.R. Pennasilico mayhem@alba.st Pescara, 22 Agosto 2008

Mac OS hacX

Things you need to know about your Mac

slide-2
SLIDE 2

Alessio L.R. Pennasilico

$ whois mayhem

Security Evangelist @ Member / Board of Directors:

AIP, AIPSI/ISSA, CLUSIT, Italian Linux Society, IT-ISAC, LUGVR, OPSI, Metro Olografix, No1984.org, OpenBeer, Sikurezza.org, Spippolatori, VoIPSA. CrISTAL, Hacker’s Profiling Project, Recursiva.org

2

slide-3
SLIDE 3

Alessio L.R. Pennasilico

Credits

These slides are possible thanks to the help of some Italian hackers that always love to share information: Andrea Ghirardini, pila@pilasecurity.com Guido Bolognesi, zen@kill-9.it Matteo G.P. Flora, lk@lastknight.com

3

slide-4
SLIDE 4

Alessio L.R. Pennasilico

“Those who don't understand UNIX are condemned to reinvent it, poorly."

Henry Spencer

4

slide-5
SLIDE 5

Alessio L.R. Pennasilico

Apple MAC AD

5

slide-6
SLIDE 6

Alessio L.R. Pennasilico - MacOSX security

How to obtain a more secure environment using MacOSX?

slide-7
SLIDE 7

Alessio L.R. Pennasilico

Screensaver

slide-8
SLIDE 8

Alessio L.R. Pennasilico

Autologon

slide-9
SLIDE 9

Alessio L.R. Pennasilico

Pair remote control

slide-10
SLIDE 10

Alessio L.R. Pennasilico

Malware

slide-11
SLIDE 11

Alessio L.R. Pennasilico - MacOSX security

Library Randomization

slide-12
SLIDE 12

Alessio L.R. Pennasilico

How security is changing?

From buffer overflow to application flaws…

“… and nowadays a ssh remote root is a dead dream...”

anonymous

12

slide-13
SLIDE 13

Alessio L.R. Pennasilico

Apple solution to BO

Library Randomization randomly distributes those commands throughout memory every time the operating system loads. Thus, even if an attacker finds a buffer overflow vulnerability and pushes his commands onto your system, it's extremely difficult for him to turn that into a working exploit.

13

slide-14
SLIDE 14

Alessio L.R. Pennasilico - MacOSX security

SandBoxes

slide-15
SLIDE 15

Alessio L.R. Pennasilico

SandBoxing

Think about isolating a baby in a place where he can play Do the same with an application!

15

slide-16
SLIDE 16

Alessio L.R. Pennasilico

Web Malware

Malware can compromise my browser But my browser must not access all my system resources

16

slide-17
SLIDE 17

Alessio L.R. Pennasilico

Policy

We can create some rules: the browser will only access authorized resources

17

slide-18
SLIDE 18

Alessio L.R. Pennasilico

It is native on MacOSX:

coniglio:~ mayhem$ man sandbox-exec coniglio:~ mayhem$ cd /usr/share/sandbox/ bsd.sb portmap.sb named.sb mDNSResponder.sb ntpd.sb syslogd.sb

18

slide-19
SLIDE 19

Alessio L.R. Pennasilico

and simple to use

$ sandbox-exec -f profile-file applicazione $ cat /usr/share/sandbox/named.sb (allow network*) (allow file-write* file-read-data file-read- metadata (regex "^(/private)?/var/run/named\\.pid$" "^/Library/Logs/named\\.log$"))

19

slide-20
SLIDE 20

Alessio L.R. Pennasilico - MacOSX security

Access Control List

slide-21
SLIDE 21

Alessio L.R. Pennasilico

File system

The file system is HFS+ Provides journaling access-list and extended attributes

21

slide-22
SLIDE 22

Alessio L.R. Pennasilico

/bin/ls -l

coniglio:~ mayhem$ /bin/ls -l total 24 drwx------+ 8 mayhem mayhem 272 May 13 18:45 Desktop

  • rw-r--r--@ 1 root mayhem 1024 Dec 10 10:41 Desktop DB
  • rw-r--r--@ 1 root mayhem 2 Dec 9 23:11 Desktop DF

drwx------+ 35 mayhem mayhem 1190 May 8 19:40 Documents

22

slide-23
SLIDE 23

Alessio L.R. Pennasilico

/bin/ls -el

coniglio:~ mayhem$ /bin/ls -le total 24 drwx------+ 8 mayhem mayhem 272 May 13 18:45 Desktop 0: group:everyone deny delete

  • rw-r--r--@ 1 root mayhem 1024 Dec 10 10:41 Desktop DB
  • rw-r--r--@ 1 root mayhem 2 Dec 9 23:11 Desktop DF

drwx------+ 35 mayhem mayhem 1190 May 8 19:40 Documents 0: group:everyone deny delete

23

slide-24
SLIDE 24

Alessio L.R. Pennasilico

/bin/chmod

# chmod +a "admin allow write" file1 # chmod +a "guest deny read" file1 # ls -le

  • rw-r--r--+ 1 juser wheel 0 Apr 28 14:06 file1
  • wner: juser

1: guest deny read 2: admin allow write

24

slide-25
SLIDE 25

Alessio L.R. Pennasilico - MacOSX security

Monitor

slide-26
SLIDE 26

Alessio L.R. Pennasilico

Why monitoring?

It’s always important to know what a binary program tries to do both from a security point of view and from a performance point of view

26

slide-27
SLIDE 27

Alessio L.R. Pennasilico

It is important to know

which file are created / accessed / deleted how much CPU / memory is used lookup thread / child processes network activities

27

slide-28
SLIDE 28

Alessio L.R. Pennasilico

dtruss

Used to run strace on your PC? Did you find an unknown binary? root@coniglio# dtruss /bin/ls

28

slide-29
SLIDE 29

Alessio L.R. Pennasilico

Running processes

It is possible to attach dtruss to already running processes to monitor syscalls

29

slide-30
SLIDE 30

Alessio L.R. Pennasilico

dtruss screencast

30

slide-31
SLIDE 31

Alessio L.R. Pennasilico

dtrace

It is useful to create profiles

  • f system wide parameters to monitor

Pre-compiled libraries can be found:

http://www.solarisinternals.com/si/dtrace/

31

slide-32
SLIDE 32

Alessio L.R. Pennasilico

Instruments

It is the GUI provided by Developer Tools It analyzes any activity of running

  • r new launched applications

32

slide-33
SLIDE 33

Alessio L.R. Pennasilico

Instruments screencast

33

slide-34
SLIDE 34

Alessio L.R. Pennasilico

Default processes

It is important to know what are the default system services. A comprehensive and updated document can be found at: http://www.westwind.com/reference/OS-X/ background-processes.html

34

slide-35
SLIDE 35

Alessio L.R. Pennasilico - MacOSX security

Firewall

slide-36
SLIDE 36

Alessio L.R. Pennasilico

Tiger or 10.4

Traffic based firewall BSD IPFW product Powerful and flexible Complex syntax for a normal user

36

slide-37
SLIDE 37

Alessio L.R. Pennasilico

Leopard or 10.5

Application based firewall

37

slide-38
SLIDE 38

Alessio L.R. Pennasilico

Configuring a firewall?

38

slide-39
SLIDE 39

Alessio L.R. Pennasilico

Application Firewall

It puts a signature file inside the application Some applications check their integrity Some applications stop working

39

slide-40
SLIDE 40

Alessio L.R. Pennasilico

From AppFW to IPFW

Thanks God: IPFW is still present You can use it from command line

40

slide-41
SLIDE 41

Alessio L.R. Pennasilico

IPFW

root@coniglio# ipfw -h ipfw syntax summary (but please do read the ipfw(8) manpage): ipfw [-acdeftTnNpqS] <command> where <command> is one of: add [num] [set N] [prob x] RULE-BODY {pipe|queue} N config PIPE-BODY [pipe|queue] {zero|delete|show} [N{,N}] set [disable N... enable N...] | move [rule] X to Y | swap X Y | show

41

slide-42
SLIDE 42

Alessio L.R. Pennasilico

IPFW GUI

Simpler interface = fewer errors Simple interface = more users

42

slide-43
SLIDE 43

Alessio L.R. Pennasilico

WaterRoof

This Italian project is an IPFW firewall frontend for Mac OS X 10.5 with an easy interface and many options.

Features include dynamic rules, bandwidth management, NAT configuration and port redirection, pre-defined rule sets and a wizard for easy configuration. You can also watch logs and graphic statistics.

43

slide-44
SLIDE 44

Alessio L.R. Pennasilico

WaterRoof

http://www.hanynet.com/waterroof/index.html

44

slide-45
SLIDE 45

Alessio L.R. Pennasilico - MacOSX security

Bonjour

slide-46
SLIDE 46

Alessio L.R. Pennasilico

Bonjour

Also known as zero-configuration networking, enables automatic discovery of computers, devices, and services on IP networks. Bonjour uses industry standard IP protocols to allow devices to automatically discover each

  • ther without the need to enter IP addresses or

configure DNS servers. In order to provide a true zero-configuration experience, Bonjour requires that devices implement three essential things.

46

slide-47
SLIDE 47

Alessio L.R. Pennasilico

Requirements

➡ Allocate IP addresses without a DHCP server. ➡

Translate between names and addresses without a DNS server.

➡

Locate or advertise services without using a directory server.

47

slide-48
SLIDE 48

Alessio L.R. Pennasilico

Useful for...

✓

Easily connect to printers

✓

Easily connect to services (i.e. VNC)

๏

Enumerate

๏

Replicate worms

48

slide-49
SLIDE 49

Alessio L.R. Pennasilico

Find VNC servers

49

slide-50
SLIDE 50

Alessio L.R. Pennasilico

  • r RDP server

50

slide-51
SLIDE 51

Alessio L.R. Pennasilico

Disable bonjour

launchctl unload -w /System/Library/\ LaunchDaemons/com.apple.mDNSResponder.plist

To re-enable it:

launchctl load -w /System/Library/ \LaunchDaemons/\com.apple.mDNSResponder.plist

51

slide-52
SLIDE 52

Alessio L.R. Pennasilico - MacOSX security

FileVault

slide-53
SLIDE 53

Alessio L.R. Pennasilico

FileVault

Will provide encrypted volumes Can transparently encrypt the whole home Can create volumes on CD / USB Key

53

slide-54
SLIDE 54

Alessio L.R. Pennasilico

/Users

FileVault will create a sparse bundle disk image AES 128 encrypted Automagically mounted at login

54

slide-55
SLIDE 55

Alessio L.R. Pennasilico

Logged off user

Empty /Users/mayhem /Users/.mayhem containing the encrypted volume The password of the volume is always corresponding to the user password

55

slide-56
SLIDE 56

Alessio L.R. Pennasilico

sparse image

It is a unique big file must be maintained default until 10.4 preserved when migrating

56

slide-57
SLIDE 57

Alessio L.R. Pennasilico

sparse bundle image

a lot of 8 MB bands (files) easier to maintain default since 10.5

57

slide-58
SLIDE 58

Alessio L.R. Pennasilico

No deniability

FileVault does not provide any plausible deniability feature. Any analyzer will easily understand if you are using one or more encrypted volumes.

58

slide-59
SLIDE 59

Alessio L.R. Pennasilico

Break in

Is it possible to violate FileVault security?

59

slide-60
SLIDE 60

Alessio L.R. Pennasilico

Past

Mac OS X 10.3 In need to analyze a FileVault volume Get in touch with a developer Retrieved the user passord from swap space After some days Apple published a new patch :)

60

slide-61
SLIDE 61

Alessio L.R. Pennasilico

Present

Mac OS X 10.4 In need to analyze a FileVault volume Windows shares enabled This create a NTLM copy of the user password :)

61

slide-62
SLIDE 62

Alessio L.R. Pennasilico

Future

Mac OS X 10.5 In need to analyze a FileVault volume ...

62

slide-63
SLIDE 63

Alessio L.R. Pennasilico

http://citp.princeton.edu/mory/

63

slide-64
SLIDE 64

Alessio L.R. Pennasilico - MacOSX security

Gaining root locally

slide-65
SLIDE 65

Alessio L.R. Pennasilico

Conditions

No ability to boot from CD Able to use single user mode No time / possibility to use John the Ripper

65

slide-66
SLIDE 66

Alessio L.R. Pennasilico

Legacy way

CMD-S # /sbin/mount -wu / # /sbin/SystemStarter # nidump passwd . OR # passwd root

66

slide-67
SLIDE 67

Alessio L.R. Pennasilico

What to do

sh-3.2# rm /var/db/.AppleSetupDone

At next reboot setup will start Then you can create a new administrator and take any needed privilege / authorization

67

slide-68
SLIDE 68

Alessio L.R. Pennasilico

Curious content :)

<dict> <key>AppleSpam</key> <string>NO</string> <key>Location</key> <string>P</string> <key>Occupation</key> <string>5</string> <key>OthersSpam</key> <string>NO</string> </dict>

68

slide-69
SLIDE 69

Alessio L.R. Pennasilico - MacOSX security

Secure Deletion

slide-70
SLIDE 70

Alessio L.R. Pennasilico

Native feature

You can do it directly from your trash bin Many 3rd part application exists

70

slide-71
SLIDE 71

Alessio L.R. Pennasilico

Erase free space

71

slide-72
SLIDE 72

Alessio L.R. Pennasilico

Methods used

72

slide-73
SLIDE 73

Alessio L.R. Pennasilico - MacOSX security

Harden

slide-74
SLIDE 74

Alessio L.R. Pennasilico

Do it easy

There are a lot of things to fix Many different sintaxes Mainly command line It would be useful to have a simple tool

74

slide-75
SLIDE 75

Alessio L.R. Pennasilico

Bastille Unix

The Bastille Hardening program "locks down" an operating system, proactively configuring the system for increased security and decreasing its susceptibility to compromise. Bastille can also assess a system's current state

  • f hardening, granularly reporting on each of

the security settings with which it works.

75

slide-76
SLIDE 76

Alessio L.R. Pennasilico

Assess

In its assessment mode, it builds a report intended to teach the user about available security settings as well as inform the user as to which settings have been tightened.

76

slide-77
SLIDE 77

Alessio L.R. Pennasilico

Harden

In its default hardening mode, it interactively asks the user questions, explains the topics of those questions, and builds a policy based on the user's answers. It then applies the policy to the system.

77

slide-78
SLIDE 78

Alessio L.R. Pennasilico

Understand

Being OSS can be useful even only to understand which parameters are evaluated http://bastille-linux.sourceforge.net/index.html

78

slide-79
SLIDE 79

Alessio L.R. Pennasilico - MacOSX security

Nice tools

slide-80
SLIDE 80

Alessio L.R. Pennasilico

iAlertu

Basically iAlertU is a car alarm for your Apple

  • Mac. iAlertU uses the built in motion to trigger

the alarm and the isight to capture the image

  • f the thief.

http://sourceforge.net/projects/ialertu/

80

slide-81
SLIDE 81

Alessio L.R. Pennasilico

Proximity

Proximity monitors the proximity of your mobile phone or other bluetooth device and executes custom AppleScripts when the device goes out of range or comes into range of your computer.

http://www.apple.com/downloads/macosx/system_disk_utilities/proximity.html

81

slide-82
SLIDE 82

Alessio L.R. Pennasilico - MacOSX security

Conclusions

slide-83
SLIDE 83

Alessio L.R. Pennasilico

Am I the apple or the mouth?

Apple OS is a UNIX you can harden it and make it secure. As usual you have to know the mechanisms to adopt and which limits your security has.

83

slide-84
SLIDE 84

Alessio L.R. Pennasilico

Web-o-grafy

http://developer.apple.com/bonjour/ http://www.macosxhints.com/article.php?story=20050707222434355 http://db.tidbits.com/article/9251 http://securosis.com/2007/11/01/investigating-the-leopard-firewall/ http://www.apple.com/macosx/features/300.html#security http://db.tidbits.com/article/9294 http://www.matasano.com/log/981/a-roundup-of-leopard-security-features/ http://www.itwire.com/content/view/15143/53/ http://www.scribd.com/doc/40500/New-Admin-Setup-Mac-OS-X-How-to

84

slide-85
SLIDE 85

Alessio L.R. Pennasilico mayhem@alba.st Pescara, 22 Agosto 2008

Thank you!

These slides are written by Alessio L.R. Pennasilico aka mayhem. They are subjected to Creative Commons Attribution- ShareAlike-2.5 version; you can copy, modify, or sell them. “Please” cite your source and use the same licence :)

Questions?