11 ms·

Validating Your Version of Xcode

87 points by davidbarker 11y ago

e28eta 11y ago
So, the next Trojan version of Xcode also needs to replace or corrupt spctl. I should look at it (on iPad currently), but it seems like the right combination of a custom Certificate Authority added to the keychain and signing your malicious Xcode with a certificate signed by the CA would help. Maybe also change the quarantine metadata on the file?
- pilif 11y ago
  > seems like the right combination of a custom Certificate Authority added to the keychain and signing your malicious Xcode with a certificate signed by the CA would help nope. Gatekeeper only accepts certificates issued by Apple. The trojan would have to patch gatekeeper itself which will be difficult once people upgrade to 10.11 and keep the System Integrity Protection enabled. Even with all the bad feelings about Apple taking more and more control away from us, there's also a huge upside to this practice, I have to admit. I guess as long as stuff is turnoffable in emergencies, I can live with the restrictions.
  - e28eta 11y ago
    I think this Tech Note says otherwise. It talks about Enterprise being able to manage code signing outside of Apple, and I believe it says with admin privileges a user can mark a CA as valid for code signing. I think code signing is voodoo for most developers, and therefore believe you could fool most of them into accepting the change if an appropriately worded dialog preceded it. https://developer.apple.com/library/mac/technotes/tn2206/_index.html https://developer.apple.com/library/mac/technotes/tn2206/_in...
    - pilif 11y ago
      I'm not sure. The way I read this is that enterprises can disable Gatekeeper and then add a CA by which the binaries need to be signed. Gatekeeper seems to really be tied to Apple's CAs. Of course, if you're willing to download XCode from a shady source, you're also willing to disable Gatekeeper when it prevents you from launching your shady copy, so the point is moot I guess. edit: Stackoverflow seems to agree: http://stackoverflow.com/questions/11833481/non-apple-issued-code-signing-certificate-can-it-work-with-mac-os-10-8-gatekeep http://stackoverflow.com/questions/11833481/non-apple-issued...
- kitsunesoba 11y ago
  That'd be fairly difficult under El Capitan as long as the user hasn't disabled rootless (even su/sudo can't modify system files with rootless on). Not sure about the signing part.
  - joosters 11y ago
    Just put a copy elsewhere and surreptitiously edit PATH so that the malicious one gets picked first. No need to delete any files.
    - kitsunesoba 11y ago
      Unless the binary is signed properly, that'll trigger the gatekeeper warning, with the the dialog mentioning a cryptically-named binary and the icon showing as a generic "headless program" terminal-looking icon. If that doesn't set off all kinds of red flags you probably deserve infection.
      - crazysim 11y ago
        I thought Gatekeeper only applies to GUI launched programs?
- joosters 11y ago
  I can't remember if Xcode asks for admin privileges or not when you install it... ...mind you, I guess that doesn't matter. If I unknowingly had a hacked version and it prompted me for my password at install, I would enter it.
  - e28eta 11y ago
    I think it does, the first thing it needs to do is "Install Additional Components" (the updated mobile device framework)
  - misiti3780 11y ago
    it does
  - deathanatos 11y ago
    It does — it requires root to agree to the XCode license: https://stackoverflow.com/questions/26197347/agreeing-to-the-xcode-ios-license-requires-admin-privileges-please-re-run-as-r https://stackoverflow.com/questions/26197347/agreeing-to-the... This seems to even be required to run things like the stock git or gcc, which I've always wondered how that isn't a violation of the GPL.
    - loumf 11y ago
      You need it for the installer to install it. I haven't read the agreement, but perhaps it makes clear that it only applies to the Apple licensed products.
    - seiji 11y ago
      Yeah, I ran across "You must agree to Apple Terms and Conditions" when running command line make after an Xcode update last week. So, then you have to run sudo make to invoke the global license agreement console interface, then you manually type 'agree', then it runs the original command, except now you're running under sudo. In this case, that means it ran make as root, leaving root-owned artifacts all over my source tree.
- devit 11y ago
  One should of course verify its integrity BEFORE installing it and letting it replace spctl. The real question is whether the spctl tool displays "Apple" in case of a valid (relative to generic CAs) certificate issued to "Apple". Hopefully that's not the case. Another risk is a specifically designed executable capable of compromising spctl.
  - X-Istence 11y ago
    On machines with Gatekeeper enabled you won't be able to open the application without it verifying the signature. Devs would have to on purpose remove that protection to run this bad version of Xcode, and after that it is practically game over.
    - e28eta 11y ago
      How about an "install" script, written in your scripting language of choice? Sufficiently obscure language, obfuscate the code, leave misleading comments and copyright statements to look like its from Apple...
      - Sephiroth87 11y ago
        It might work, but an "experienced" developer might know that there no install script for Xcode (also, an experienced developer will probably not download from a random server, so i guess that's something...)
- andreyf 11y ago
  So, the next Trojan version of Xcode also needs to replace or corrupt spctl. I think that's what SIP is for: https://en.wikipedia.org/wiki/System_Integrity_Protection https://en.wikipedia.org/wiki/System_Integrity_Protection
cjensen 11y ago
Am I understanding this correctly: the devs who downloaded Xcode from an unknown source disabled gatekeeper to get it to run? That's unbelievably stupid dev behavior, if true.
- stephenr 11y ago
  They downloaded Xcode from somewhere besides Apple. How much more clue do you need about their stupidity.
  - cjensen 11y ago
    Gatekeeper makes that a lot safer than you might think. The only downside is that it's not obvious how to check who signed it. If you could easily verify it's signed by Apple, that would be 100% safe.
    - perrycynic 11y ago
      $ spctl --assess --verbose /path/to/.app
- jlarocco 11y ago
  I don't think having Gatekeeper disabled is a very big deal. It's one of the first things I disable on a new Mac. I've never had it stop an actual piece of malware, and it triggers false positives on practically everything. That said, I have no idea why anybody would download XCode from a third party...
  - nadams 11y ago
    > That said, I have no idea why anybody would download XCode from a third party... Easily explainable really. Went to [their favorite search engine], searched for "Xcode download" and clicked the first result which may not be from Apple (or an advertising).
    - gpvos 11y ago
simonvc 11y ago
What output is expected when you run the command? I get: $ spctl --assess --verbose /Applications/Xcode.app /Applications/Xcode.app: rejected source=obsolete resource envelope I downloaded XCode via the app store, but have disabled gatekeeper (re-enabled it before running this command).
- urda 11y ago
  /Applications/Xcode.app: accepted source=Mac App Store /Applications/Xcode.app: accepted source=Apple /Applications/Xcode.app: accepted source=Apple System Are the only valid options. You should remove XCode and reinstall it from Apple.
- brobinson 11y ago
  I get this with latest XCode from the App Store: $ spctl --assess --verbose /Applications/Xcode.app /Applications/Xcode.app: accepted source=Mac App Store
- Laaw 11y ago
  I got: /Applications/Xcode.app: accepted source=Mac App Store override=security disabled Which I think means I have Gatekeeper disabled, but it still gave me the 'accepted' response.
  - justinzollars 11y ago
    I also have this. I'm curious if I have a hacked version.
  - justinzollars 11y ago
    Okay, yes it means Gatekeeper is disabled after enabling the feature I see the expected output. jzollars$ spctl --assess --verbose /Applications/Xcode.app /Applications/Xcode.app: accepted source=Mac App Store
  - perrycynic 11y ago
    Spctl(1) gives you Gatekeeper's acceptance status. If you disabled it, it will (almost) always say "accepted", but in this case it may be "accepted because you turned me off, you XXX." Check the spctl(1) manpage for more options. A recent version will support the --enforce-assessment option to tell you what the real answer is. And turn the dang thing back on while you're at it. :-)
pawelkomarnicki 11y ago
I always download the XCode from AppStore, I didn't even know you can do it from another source :D
0x0 11y ago
Some news sources said Angry Birds 2 was trojanized, but "only" for the Chinese version. Anyone have any more info on that? Because I didn't think you could have separate binaries per location? Unless it is actually two entirely separate apps? And why would they even have a separate binary for the Chinese market (and why would they use a different build environment?)
- chrisdroukas 11y ago
  It appears that a Chinese company named Kunlun licensed IP from Rovio and is developing Angry Birds apps specifically for the Chinese market. Perhaps they're also distributing the app themselves. http://www.rovio.com/en/news/press-releases/621/rovio-gets-wings-to-fly-angry-birds-higher-in-china/2015 http://www.rovio.com/en/news/press-releases/621/rovio-gets-w...
  - 0x0 11y ago
    Interesting. Can you imagine the damage done to Rovio's credibility, simply because their licensee got hit? The news sites only talk about "You should delete Angry Birds 2". Nobody ever mentions or explains this third party.
ghshephard 11y ago
Presuming, of course, that whatever process may have corrupted your version of Xcode didn't also corrupt spctl. Heh.
- andreyf 11y ago
  That shouldn't be possible after OS X 10.11: https://en.wikipedia.org/wiki/System_Integrity_Protection https://en.wikipedia.org/wiki/System_Integrity_Protection
hamstergene 11y ago
I've just run the recommended check on freshly downloaded older versions (5.1.1 and 4.6.3), and their both appear rejected (source=matched cdhash).
- perrycynic 11y ago
  These are explicit overrides programmed into Gatekeeper to deal with weak Xcode signatures during the transition time to stronger signatures. They're not a danger. Of course, Apple will tell you that you should use newer devtools than that. :-)
mwcampbell 11y ago
I wonder how Apple could even tell that the apps in question were built with a counterfeit version of Xcode.
- 0x0 11y ago
  They probably scan for tell-tale trojan strings (like the C&C hostname) in the binaries.
patmcc 11y ago
I'm getting "a sealed resource is missing or invalid", with a copy of Xcode I know was installed from the App Store. Any ideas?
- davidkhess 11y ago
  If you use `codesign -v --verbose /Applications/Xcode.app` you may see: file added: /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/share/man/whatis file added: /Applications/Xcode.app/Contents/Developer/usr/share/man/whatis That should be safe. It's a bit of a shock that Apple: 1) is modifying sealed containers post-install (it's the weekly periodic job that rebuilds whatis database from installed man pages) 2) doesn't realize this and has put out instructions that will cause lots of false positives
  - patmcc 11y ago
    Thanks! Yep that was it, I owe you one.
zmxv 11y ago
The XCode trojan author is believed to have also backdoored the Unity3D engine. https://news.ycombinator.com/item?id=10256998 https://news.ycombinator.com/item?id=10256998
hjuutilainen 11y ago
The problem with "spctl" is that it also evaluates trust which depends on your system settings and you have to pay attention to the output (as pointed out in the article). If you only want to verify the code signature _and_ provide your own requirement string, you could use something like (long options for legibility): $ codesign --verify --verbose --deep --test-requirement "=anchor apple" /Applications/Xcode.app/ The "anchor apple" means Apple’s own code, signed by Apple ("anchor apple generic" for developer IDs too). Add verbosity for all the gory details: $ codesign --verify --verbose=999 --deep --test-requirement "=anchor apple" /Applications/Xcode.app/
- perrycynic 11y ago
  Note that "anchor apple" means "signed by Apple's build system". It will not cover the Xcode you get from the Mac App Store (it uses a different kind of signature). This incantation is good enough to check for "an Xcode I legitimately got from a web page download."
gress 11y ago
The responses on this thread seem to prove that Apple knows what it is doing with its security strategy. The fact that people blindly disable protections and end up causing massive malware outbreaks is exactly the reason they are introducing things like Gatekeeper and Rootless. Arguably, this incident is evidence in favor of them locking down Gatekeeper further.
ksec 11y ago
Yes, there are connection problem downloading Xcode from Apple'site. Since there is GFW. But my biggest question of why, Apple manage to get CDN for their Live Streaming Event, App Store, and Mac Apps but not for their developer references and tools. A honest mistake? Or Sloppiness from their Cloud "Services" again?

87 points by davidbarker 11y ago

So, the next Trojan version of Xcode also needs to replace or corrupt spctl. I should look at it (on iPad currently), but it seems like the right combination of a custom Certificate Authority added to the keychain and signing your malicious Xcode with a certificate signed by the CA would help. Maybe also change the quarantine metadata on the file?

pilif 11y ago
> seems like the right combination of a custom Certificate Authority added to the keychain and signing your malicious Xcode with a certificate signed by the CA would help nope. Gatekeeper only accepts certificates issued by Apple. The trojan would have to patch gatekeeper itself which will be difficult once people upgrade to 10.11 and keep the System Integrity Protection enabled. Even with all the bad feelings about Apple taking more and more control away from us, there's also a huge upside to this practice, I have to admit. I guess as long as stuff is turnoffable in emergencies, I can live with the restrictions.
- e28eta 11y ago
  I think this Tech Note says otherwise. It talks about Enterprise being able to manage code signing outside of Apple, and I believe it says with admin privileges a user can mark a CA as valid for code signing. I think code signing is voodoo for most developers, and therefore believe you could fool most of them into accepting the change if an appropriately worded dialog preceded it. https://developer.apple.com/library/mac/technotes/tn2206/_index.html https://developer.apple.com/library/mac/technotes/tn2206/_in...
  - pilif 11y ago
    I'm not sure. The way I read this is that enterprises can disable Gatekeeper and then add a CA by which the binaries need to be signed. Gatekeeper seems to really be tied to Apple's CAs. Of course, if you're willing to download XCode from a shady source, you're also willing to disable Gatekeeper when it prevents you from launching your shady copy, so the point is moot I guess. edit: Stackoverflow seems to agree: http://stackoverflow.com/questions/11833481/non-apple-issued-code-signing-certificate-can-it-work-with-mac-os-10-8-gatekeep http://stackoverflow.com/questions/11833481/non-apple-issued...
kitsunesoba 11y ago
That'd be fairly difficult under El Capitan as long as the user hasn't disabled rootless (even su/sudo can't modify system files with rootless on). Not sure about the signing part.
- joosters 11y ago
  Just put a copy elsewhere and surreptitiously edit PATH so that the malicious one gets picked first. No need to delete any files.
  - kitsunesoba 11y ago
    Unless the binary is signed properly, that'll trigger the gatekeeper warning, with the the dialog mentioning a cryptically-named binary and the icon showing as a generic "headless program" terminal-looking icon. If that doesn't set off all kinds of red flags you probably deserve infection.
    - crazysim 11y ago
      I thought Gatekeeper only applies to GUI launched programs?
joosters 11y ago
I can't remember if Xcode asks for admin privileges or not when you install it... ...mind you, I guess that doesn't matter. If I unknowingly had a hacked version and it prompted me for my password at install, I would enter it.
- e28eta 11y ago
  I think it does, the first thing it needs to do is "Install Additional Components" (the updated mobile device framework)
- misiti3780 11y ago
  it does
- deathanatos 11y ago
  It does — it requires root to agree to the XCode license: https://stackoverflow.com/questions/26197347/agreeing-to-the-xcode-ios-license-requires-admin-privileges-please-re-run-as-r https://stackoverflow.com/questions/26197347/agreeing-to-the... This seems to even be required to run things like the stock git or gcc, which I've always wondered how that isn't a violation of the GPL.
  - loumf 11y ago
    You need it for the installer to install it. I haven't read the agreement, but perhaps it makes clear that it only applies to the Apple licensed products.
  - seiji 11y ago
    Yeah, I ran across "You must agree to Apple Terms and Conditions" when running command line make after an Xcode update last week. So, then you have to run sudo make to invoke the global license agreement console interface, then you manually type 'agree', then it runs the original command, except now you're running under sudo. In this case, that means it ran make as root, leaving root-owned artifacts all over my source tree.
devit 11y ago
One should of course verify its integrity BEFORE installing it and letting it replace spctl. The real question is whether the spctl tool displays "Apple" in case of a valid (relative to generic CAs) certificate issued to "Apple". Hopefully that's not the case. Another risk is a specifically designed executable capable of compromising spctl.
- X-Istence 11y ago
  On machines with Gatekeeper enabled you won't be able to open the application without it verifying the signature. Devs would have to on purpose remove that protection to run this bad version of Xcode, and after that it is practically game over.
  - e28eta 11y ago
    How about an "install" script, written in your scripting language of choice? Sufficiently obscure language, obfuscate the code, leave misleading comments and copyright statements to look like its from Apple...
    - Sephiroth87 11y ago
      It might work, but an "experienced" developer might know that there no install script for Xcode (also, an experienced developer will probably not download from a random server, so i guess that's something...)
andreyf 11y ago
So, the next Trojan version of Xcode also needs to replace or corrupt spctl. I think that's what SIP is for: https://en.wikipedia.org/wiki/System_Integrity_Protection https://en.wikipedia.org/wiki/System_Integrity_Protection

cjensen 11y ago

Am I understanding this correctly: the devs who downloaded Xcode from an unknown source disabled gatekeeper to get it to run? That's unbelievably stupid dev behavior, if true.

stephenr 11y ago
They downloaded Xcode from somewhere besides Apple. How much more clue do you need about their stupidity.
- cjensen 11y ago
  Gatekeeper makes that a lot safer than you might think. The only downside is that it's not obvious how to check who signed it. If you could easily verify it's signed by Apple, that would be 100% safe.
  - perrycynic 11y ago
    $ spctl --assess --verbose /path/to/.app
jlarocco 11y ago
I don't think having Gatekeeper disabled is a very big deal. It's one of the first things I disable on a new Mac. I've never had it stop an actual piece of malware, and it triggers false positives on practically everything. That said, I have no idea why anybody would download XCode from a third party...
- nadams 11y ago
  > That said, I have no idea why anybody would download XCode from a third party... Easily explainable really. Went to [their favorite search engine], searched for "Xcode download" and clicked the first result which may not be from Apple (or an advertising).
  - gpvos 11y ago

simonvc 11y ago

What output is expected when you run the command? I get: $ spctl --assess --verbose /Applications/Xcode.app /Applications/Xcode.app: rejected source=obsolete resource envelope I downloaded XCode via the app store, but have disabled gatekeeper (re-enabled it before running this command).

urda 11y ago
/Applications/Xcode.app: accepted source=Mac App Store /Applications/Xcode.app: accepted source=Apple /Applications/Xcode.app: accepted source=Apple System Are the only valid options. You should remove XCode and reinstall it from Apple.
brobinson 11y ago
I get this with latest XCode from the App Store: $ spctl --assess --verbose /Applications/Xcode.app /Applications/Xcode.app: accepted source=Mac App Store
Laaw 11y ago
I got: /Applications/Xcode.app: accepted source=Mac App Store override=security disabled Which I think means I have Gatekeeper disabled, but it still gave me the 'accepted' response.
- justinzollars 11y ago
  I also have this. I'm curious if I have a hacked version.
- justinzollars 11y ago
  Okay, yes it means Gatekeeper is disabled after enabling the feature I see the expected output. jzollars$ spctl --assess --verbose /Applications/Xcode.app /Applications/Xcode.app: accepted source=Mac App Store
- perrycynic 11y ago
  Spctl(1) gives you Gatekeeper's acceptance status. If you disabled it, it will (almost) always say "accepted", but in this case it may be "accepted because you turned me off, you XXX." Check the spctl(1) manpage for more options. A recent version will support the --enforce-assessment option to tell you what the real answer is. And turn the dang thing back on while you're at it. :-)

pawelkomarnicki 11y ago

I always download the XCode from AppStore, I didn't even know you can do it from another source :D

0x0 11y ago

Some news sources said Angry Birds 2 was trojanized, but "only" for the Chinese version. Anyone have any more info on that? Because I didn't think you could have separate binaries per location? Unless it is actually two entirely separate apps? And why would they even have a separate binary for the Chinese market (and why would they use a different build environment?)

chrisdroukas 11y ago
It appears that a Chinese company named Kunlun licensed IP from Rovio and is developing Angry Birds apps specifically for the Chinese market. Perhaps they're also distributing the app themselves. http://www.rovio.com/en/news/press-releases/621/rovio-gets-wings-to-fly-angry-birds-higher-in-china/2015 http://www.rovio.com/en/news/press-releases/621/rovio-gets-w...
- 0x0 11y ago
  Interesting. Can you imagine the damage done to Rovio's credibility, simply because their licensee got hit? The news sites only talk about "You should delete Angry Birds 2". Nobody ever mentions or explains this third party.

ghshephard 11y ago

Presuming, of course, that whatever process may have corrupted your version of Xcode didn't also corrupt spctl. Heh.

andreyf 11y ago
That shouldn't be possible after OS X 10.11: https://en.wikipedia.org/wiki/System_Integrity_Protection https://en.wikipedia.org/wiki/System_Integrity_Protection

hamstergene 11y ago

I've just run the recommended check on freshly downloaded older versions (5.1.1 and 4.6.3), and their both appear rejected (source=matched cdhash).

perrycynic 11y ago
These are explicit overrides programmed into Gatekeeper to deal with weak Xcode signatures during the transition time to stronger signatures. They're not a danger. Of course, Apple will tell you that you should use newer devtools than that. :-)

mwcampbell 11y ago

I wonder how Apple could even tell that the apps in question were built with a counterfeit version of Xcode.

0x0 11y ago
They probably scan for tell-tale trojan strings (like the C&C hostname) in the binaries.

patmcc 11y ago

I'm getting "a sealed resource is missing or invalid", with a copy of Xcode I know was installed from the App Store. Any ideas?

davidkhess 11y ago
If you use `codesign -v --verbose /Applications/Xcode.app` you may see: file added: /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/share/man/whatis file added: /Applications/Xcode.app/Contents/Developer/usr/share/man/whatis That should be safe. It's a bit of a shock that Apple: 1) is modifying sealed containers post-install (it's the weekly periodic job that rebuilds whatis database from installed man pages) 2) doesn't realize this and has put out instructions that will cause lots of false positives
- patmcc 11y ago
  Thanks! Yep that was it, I owe you one.

zmxv 11y ago

The XCode trojan author is believed to have also backdoored the Unity3D engine. https://news.ycombinator.com/item?id=10256998 https://news.ycombinator.com/item?id=10256998

hjuutilainen 11y ago

The problem with "spctl" is that it also evaluates trust which depends on your system settings and you have to pay attention to the output (as pointed out in the article). If you only want to verify the code signature _and_ provide your own requirement string, you could use something like (long options for legibility): $ codesign --verify --verbose --deep --test-requirement "=anchor apple" /Applications/Xcode.app/ The "anchor apple" means Apple’s own code, signed by Apple ("anchor apple generic" for developer IDs too). Add verbosity for all the gory details: $ codesign --verify --verbose=999 --deep --test-requirement "=anchor apple" /Applications/Xcode.app/

perrycynic 11y ago
Note that "anchor apple" means "signed by Apple's build system". It will not cover the Xcode you get from the Mac App Store (it uses a different kind of signature). This incantation is good enough to check for "an Xcode I legitimately got from a web page download."

gress 11y ago

The responses on this thread seem to prove that Apple knows what it is doing with its security strategy. The fact that people blindly disable protections and end up causing massive malware outbreaks is exactly the reason they are introducing things like Gatekeeper and Rootless. Arguably, this incident is evidence in favor of them locking down Gatekeeper further.

ksec 11y ago

Yes, there are connection problem downloading Xcode from Apple'site. Since there is GFW. But my biggest question of why, Apple manage to get CDN for their Live Streaming Event, App Store, and Mac Apps but not for their developer references and tools. A honest mistake? Or Sloppiness from their Cloud "Services" again?