Sometimes all it takes to root out a new software vulnerability is to study and analyze previous bug reports. That's how researcher Csaba Fitzl says he sniffed out some new Apple macOS vulnerabilities, one of which was a mirror image of a logic flaw that a group of researchers competing in the 2020 Pwn2Own contest found and executed there.

Fitzl, a content developer for Offensive Security, says he reread and studied the winning six-exploit chain that the researchers used to hack macOS. One of the exploits in that chain weaponized a privilege escalation bug, which Apple later fixed. But there still was a hole, and he found it: "Although Apple fixed it properly, but still there was an extra function ... that basically opened up another vulnerability to be utilized a bit differently than the original one," Fitzl explains.

Apple's original fix for the flaw allowed an attacker to change ownership of a directory in macOS. But Fitzl discovered that he could create a new directory on the targeted system, which could allow an attacker to escalate their privileges on macOS. "Although you had to use different techniques to get through to the system, but because you could create an arbitrary directory anywhere on the system, you could elevate your privileges to root," he says.

It was basically the same logic flaw but in a different piece of the code. Apple has since patched the vulnerability Fitzl found as well.

This week at Black Hat Singapore, Fitzl will share technical details of this and two other vulns he found while drilling down on previous vuln research on macOS during a session entitled "macOS Vulnerabilities Hiding in Plain Sight."

Apple had not responded to a request for comment as of this posting.

'Something Is Not Right'
Fitzl says he didn't actually spot traces of the new flaws linked to previous research until after he reread the research papers. "At some point it hit me that there is something not right. It turned out that there is a vulnerability not like the one initially documented," he explains of his findings. "That eventually led to me to find or identify new vulnerabilities."

The other two flaws he found include one that built upon research from Mickey Jin, who discovered a bypass for an Apple patch for the so-called XCSSET malware that targeted Apple's built-in Transparency, Consent, and Control (TCC) privacy and security framework. XCSSET pilfers sensitive user and developer information from applications on a Mac machine.

Fitzl says he noticed an underlying weakness in the TCC framework that would allow an attacker to bypass TCC. He consulted with fellow researcher Wojciech Regula, head of mobile security and principal security consultant at SecuRing, on the issue.

"We found that we can still generically bypass TCC because there was an inherent vulnerability" that came out of the previous research, he says. It was a flaw in TCC that could allow an attacker to bypass the macOS privacy and security framework.

While macOS relies heavily on code-signing and verification of code-signing, Fitzl explains, TCC was not verifying a process that was running but rather verifying binary code on the disk. "This allowed all these abuses by malware," he says. "So we just replaced the binary on the disk and that's it: We could bypass TCC again."

Apple has since fixed the issue, he says.

The third macOS vuln Fitzl found builds off a flaw used in a 2017 Pwn2Own macOS exploit chain: another privilege escalation flaw that Apple later patched in its disk arbitration framework to elevate to root access. Then Fitzl found that the new version of Apple's disk arbitration source code included the "exact same" logic bug that could lead to privilege escalation. "You could use the same logic bug to escape the [macOS] sandbox" that keeps applications from getting access to other parts of the machine they don't need, he says.

For example, an attacker could abuse the vulnerability to escape Safari's sandbox and gain broader access across the victim's machine.

Protecting macOS
Fitzl recommends that organizations religiously update their Macs with the latest versions of macOS to keep their endpoints protected from attacks such as these. They should also run anti-malware and endpoint detection and response on their machines.