Mac OS X

Misc
by

Forklift <=3.3.9 and <=3.4 Local Privilege Escalations on macOS (CVE-2020-15349/CVE-2020-27192)

I have started to have a look at my local installed helpers on macOS. These helpers are used as an interface for applications to perform privileged operations on the system. Thus, it is quite a nice attack surface to search for Local Privilege Escalations.

Forklift is an advanced dual pane file manager for macOS. It is well known under macOS power users.

As part of my investigation I identified vulnerabilities in Forklift allowing local privilege escalation.

Continue reading
Misc
by

macOS Mojave Hardening Guide

Due to the new release of macOS Mojave in September we updated the El Capitan hardening guide.

The hardening guide received a little revamp on some chapters which are now obsolete or had to be changed due to the new features of macOS Mojave. Further, the hardening guide got extended for the new privacy features in macOS Mojave.

You can check it out here. We hope some of you might find it helpful.
Cheers,
Birk

Continue reading
Building
by

IPv6 Hardening Guide for OS X

Similar to the documents we released for Linux and Windows (and actually inspired by a comment to the post on the Linux guide) Antonios wrote another guide, this time for Mac OS X.

It can be found here. We hope some of you might find it helpful.
Have a great day

Enno

PS: in the past we also made a general Mac OS X hardening document available and we’ve discussed an additional patch in this post.

Continue reading
Building
by

Basic OS X Hardening & DMA

In the course of a recent endpoint assessment, we also had a OS X 10.8 client system as a target. While we still rely on the Firewire “capability” of unlocking systems on a regular base (using this great tool), we noticed that Apple released a patch to disable Firewire DMA access whenever the system is in a locked state (e.g. with an active screensaver or no user logged in). As we test the Firewire DMA access vulnerability quite often (at least we thought so 😉 ) to prepare for demonstrations in the board room or client assessments, we were quite surprised that we must have actually missed that nice update. In order to verify the effectiveness of the patch, we ran our typical test bed and can quite happily confirm that the update successfully mitigates Firewire DMA access in locked system states.

Continue reading