5 ms·

So, the next Trojan version of Xcode also needs to replace or corrupt spctl. I should look at it (on iPad currently), but it seems like the right combination o

by e28eta 11y ago

So, the next Trojan version of Xcode also needs to replace or corrupt spctl. I should look at it (on iPad currently), but it seems like the right combination of a custom Certificate Authority added to the keychain and signing your malicious Xcode with a certificate signed by the CA would help. Maybe also change the quarantine metadata on the file?

pilif 11y ago
> seems like the right combination of a custom Certificate Authority added to the keychain and signing your malicious Xcode with a certificate signed by the CA would help nope. Gatekeeper only accepts certificates issued by Apple. The trojan would have to patch gatekeeper itself which will be difficult once people upgrade to 10.11 and keep the System Integrity Protection enabled. Even with all the bad feelings about Apple taking more and more control away from us, there's also a huge upside to this practice, I have to admit. I guess as long as stuff is turnoffable in emergencies, I can live with the restrictions.
- e28eta 11y ago
  I think this Tech Note says otherwise. It talks about Enterprise being able to manage code signing outside of Apple, and I believe it says with admin privileges a user can mark a CA as valid for code signing. I think code signing is voodoo for most developers, and therefore believe you could fool most of them into accepting the change if an appropriately worded dialog preceded it. https://developer.apple.com/library/mac/technotes/tn2206/_index.html https://developer.apple.com/library/mac/technotes/tn2206/_in...
  - pilif 11y ago
    I'm not sure. The way I read this is that enterprises can disable Gatekeeper and then add a CA by which the binaries need to be signed. Gatekeeper seems to really be tied to Apple's CAs. Of course, if you're willing to download XCode from a shady source, you're also willing to disable Gatekeeper when it prevents you from launching your shady copy, so the point is moot I guess. edit: Stackoverflow seems to agree: http://stackoverflow.com/questions/11833481/non-apple-issued-code-signing-certificate-can-it-work-with-mac-os-10-8-gatekeep http://stackoverflow.com/questions/11833481/non-apple-issued...
kitsunesoba 11y ago
That'd be fairly difficult under El Capitan as long as the user hasn't disabled rootless (even su/sudo can't modify system files with rootless on). Not sure about the signing part.
- joosters 11y ago
  Just put a copy elsewhere and surreptitiously edit PATH so that the malicious one gets picked first. No need to delete any files.
  - kitsunesoba 11y ago
    Unless the binary is signed properly, that'll trigger the gatekeeper warning, with the the dialog mentioning a cryptically-named binary and the icon showing as a generic "headless program" terminal-looking icon. If that doesn't set off all kinds of red flags you probably deserve infection.
    - crazysim 11y ago
      I thought Gatekeeper only applies to GUI launched programs?
joosters 11y ago
I can't remember if Xcode asks for admin privileges or not when you install it... ...mind you, I guess that doesn't matter. If I unknowingly had a hacked version and it prompted me for my password at install, I would enter it.
- e28eta 11y ago
  I think it does, the first thing it needs to do is "Install Additional Components" (the updated mobile device framework)
- misiti3780 11y ago
  it does
- deathanatos 11y ago
  It does — it requires root to agree to the XCode license: https://stackoverflow.com/questions/26197347/agreeing-to-the-xcode-ios-license-requires-admin-privileges-please-re-run-as-r https://stackoverflow.com/questions/26197347/agreeing-to-the... This seems to even be required to run things like the stock git or gcc, which I've always wondered how that isn't a violation of the GPL.
  - loumf 11y ago
    You need it for the installer to install it. I haven't read the agreement, but perhaps it makes clear that it only applies to the Apple licensed products.
  - seiji 11y ago
    Yeah, I ran across "You must agree to Apple Terms and Conditions" when running command line make after an Xcode update last week. So, then you have to run sudo make to invoke the global license agreement console interface, then you manually type 'agree', then it runs the original command, except now you're running under sudo. In this case, that means it ran make as root, leaving root-owned artifacts all over my source tree.
devit 11y ago
One should of course verify its integrity BEFORE installing it and letting it replace spctl. The real question is whether the spctl tool displays "Apple" in case of a valid (relative to generic CAs) certificate issued to "Apple". Hopefully that's not the case. Another risk is a specifically designed executable capable of compromising spctl.
- X-Istence 11y ago
  On machines with Gatekeeper enabled you won't be able to open the application without it verifying the signature. Devs would have to on purpose remove that protection to run this bad version of Xcode, and after that it is practically game over.
  - e28eta 11y ago
    How about an "install" script, written in your scripting language of choice? Sufficiently obscure language, obfuscate the code, leave misleading comments and copyright statements to look like its from Apple...
    - Sephiroth87 11y ago
      It might work, but an "experienced" developer might know that there no install script for Xcode (also, an experienced developer will probably not download from a random server, so i guess that's something...)
andreyf 11y ago
So, the next Trojan version of Xcode also needs to replace or corrupt spctl. I think that's what SIP is for: https://en.wikipedia.org/wiki/System_Integrity_Protection https://en.wikipedia.org/wiki/System_Integrity_Protection

by e28eta 11y ago

pilif 11y ago

> seems like the right combination of a custom Certificate Authority added to the keychain and signing your malicious Xcode with a certificate signed by the CA would help nope. Gatekeeper only accepts certificates issued by Apple. The trojan would have to patch gatekeeper itself which will be difficult once people upgrade to 10.11 and keep the System Integrity Protection enabled. Even with all the bad feelings about Apple taking more and more control away from us, there's also a huge upside to this practice, I have to admit. I guess as long as stuff is turnoffable in emergencies, I can live with the restrictions.

e28eta 11y ago
I think this Tech Note says otherwise. It talks about Enterprise being able to manage code signing outside of Apple, and I believe it says with admin privileges a user can mark a CA as valid for code signing. I think code signing is voodoo for most developers, and therefore believe you could fool most of them into accepting the change if an appropriately worded dialog preceded it. https://developer.apple.com/library/mac/technotes/tn2206/_index.html https://developer.apple.com/library/mac/technotes/tn2206/_in...
- pilif 11y ago
  I'm not sure. The way I read this is that enterprises can disable Gatekeeper and then add a CA by which the binaries need to be signed. Gatekeeper seems to really be tied to Apple's CAs. Of course, if you're willing to download XCode from a shady source, you're also willing to disable Gatekeeper when it prevents you from launching your shady copy, so the point is moot I guess. edit: Stackoverflow seems to agree: http://stackoverflow.com/questions/11833481/non-apple-issued-code-signing-certificate-can-it-work-with-mac-os-10-8-gatekeep http://stackoverflow.com/questions/11833481/non-apple-issued...

kitsunesoba 11y ago

That'd be fairly difficult under El Capitan as long as the user hasn't disabled rootless (even su/sudo can't modify system files with rootless on). Not sure about the signing part.

joosters 11y ago
Just put a copy elsewhere and surreptitiously edit PATH so that the malicious one gets picked first. No need to delete any files.
- kitsunesoba 11y ago
  Unless the binary is signed properly, that'll trigger the gatekeeper warning, with the the dialog mentioning a cryptically-named binary and the icon showing as a generic "headless program" terminal-looking icon. If that doesn't set off all kinds of red flags you probably deserve infection.
  - crazysim 11y ago
    I thought Gatekeeper only applies to GUI launched programs?

joosters 11y ago

I can't remember if Xcode asks for admin privileges or not when you install it... ...mind you, I guess that doesn't matter. If I unknowingly had a hacked version and it prompted me for my password at install, I would enter it.

e28eta 11y ago
I think it does, the first thing it needs to do is "Install Additional Components" (the updated mobile device framework)
misiti3780 11y ago
it does
deathanatos 11y ago
It does — it requires root to agree to the XCode license: https://stackoverflow.com/questions/26197347/agreeing-to-the-xcode-ios-license-requires-admin-privileges-please-re-run-as-r https://stackoverflow.com/questions/26197347/agreeing-to-the... This seems to even be required to run things like the stock git or gcc, which I've always wondered how that isn't a violation of the GPL.
- loumf 11y ago
  You need it for the installer to install it. I haven't read the agreement, but perhaps it makes clear that it only applies to the Apple licensed products.
- seiji 11y ago
  Yeah, I ran across "You must agree to Apple Terms and Conditions" when running command line make after an Xcode update last week. So, then you have to run sudo make to invoke the global license agreement console interface, then you manually type 'agree', then it runs the original command, except now you're running under sudo. In this case, that means it ran make as root, leaving root-owned artifacts all over my source tree.

devit 11y ago

One should of course verify its integrity BEFORE installing it and letting it replace spctl. The real question is whether the spctl tool displays "Apple" in case of a valid (relative to generic CAs) certificate issued to "Apple". Hopefully that's not the case. Another risk is a specifically designed executable capable of compromising spctl.

X-Istence 11y ago
On machines with Gatekeeper enabled you won't be able to open the application without it verifying the signature. Devs would have to on purpose remove that protection to run this bad version of Xcode, and after that it is practically game over.
- e28eta 11y ago
  How about an "install" script, written in your scripting language of choice? Sufficiently obscure language, obfuscate the code, leave misleading comments and copyright statements to look like its from Apple...
  - Sephiroth87 11y ago
    It might work, but an "experienced" developer might know that there no install script for Xcode (also, an experienced developer will probably not download from a random server, so i guess that's something...)

andreyf 11y ago

So, the next Trojan version of Xcode also needs to replace or corrupt spctl. I think that's what SIP is for: https://en.wikipedia.org/wiki/System_Integrity_Protection https://en.wikipedia.org/wiki/System_Integrity_Protection