DoNotDisturb: Detect Evil Maid Attacks

April 25, 2018 ~ hucktech ~ 2 Comments

1️⃣ Go on Tinder date in Moscow 🇷🇺
2️⃣ Realize date works for Russian govt (MFA) 😅
3️⃣ Create app to detect 'Evil Maid' attacks…like, while out on a date 🛡️

"Do Not Disturb" #free https://t.co/R6IKMaCGUx

kudos to venerable @thegrugq for 'lid open' trigger idea! 🙏

— patrick wardle (@patrickwardle) April 24, 2018

https://github.com/objective-see/DoNotDisturb

https://objective-see.com/products/dnd.html

Command-Line-EFI-Mounter: Command Line EFI Mounter for Mac

April 11, 2018 ~ hucktech ~ Leave a comment

Command Line EFI Mounter
This is a simple app that helps you to mount any EFI partition Inside Mac OS X.
Working for Mac OS X 10.9 to 10.13

https://github.com/chris1111/Command-Line-EFI-Mounter

EFIClone: macOS scripts to clone the EFI System partition

February 23, 2018 ~ hucktech ~ Leave a comment

macOS Shell Scripts to clone the EFI partition automatically from either Carbon Copy Cloner or SuperDuper! when run on a Hackintosh

https://github.com/wombat94/EFIClone

MountEFI – mac tool to select drive containing an EFI to mount

February 4, 2018 ~ hucktech ~ 1 Comment

This Mac-centric bash script has been rewritten as a Mac-centric Python script:

“A more robust edition of my previous MountEFI script. Added my usual collection of disk functions – plus some experimentation with callback functions.

def custom_quit():
     head(“MountEFI”)
     print(“by CorpNewt\n”)
     print(“Thanks for testing it out, for bugs/comments/complaints”)
     print(“send me a message on Reddit, or check out my GitHub:\n”)
     print(“www.reddit.com/u/corpnewt”)
     print(“www.github.com/corpnewt\n”)
     print(“Have a nice day/night!\n\n”)
exit(0)

https://github.com/corpnewt/MountEFI

Apple updates macOS for Meltdown

January 23, 2018 ~ hucktech ~ Leave a comment

10.13.3 is out – and 10.12 and 10.11 got Meltdown patches!https://t.co/7QarAmwlEa

— mikeymikey (@mikeymikey) January 23, 2018

Interesting that Apple describes meltdown as requiring indirect branches. That is wrong. https://t.co/BD9UI0t8tx

— Anders Fogh (@anders_fogh) January 23, 2018

https://support.apple.com/en-us/HT208465

Punchdrum: macOS GUI for bootoption

January 6, 2018 ~ hucktech ~ Leave a comment

GUI wrapper for bootoption that creates a bootable (systemd-boot) flash drive for the sole purpose of adding a loader to the firmware menu.

https://github.com/vulgo/Punchdrum

Punchdrum screenshot

macOS vuln in IOHIDFamily

January 1, 2018 ~ hucktech ~ Leave a comment

Fuck it, dropping a macOS 0day. Happy New Year, everyone. https://t.co/oG2nOlUOjk

— Siguza (@s1guza) December 31, 2017

Siguza, 01. Dec 2017 (published 31. Dec 2017)
IOHIDeous

“IOHIDFamily once again.”
This is the tale of a macOS-only vulnerability in IOHIDFamily that yields kernel r/w and can be exploited by any unprivileged user. IOHIDFamily has been notorious in the past for the many race conditions it contained, which ultimately lead to large parts of it being rewritten to make use of command gates, as well as large parts being locked down by means of entitlements. I was originally looking through its source in the hope of finding a low-hanging fruit that would let me compromise an iOS kernel, but what I didn’t know it then is that some parts of IOHIDFamily exist only on macOS – specifically IOHIDSystem, which contains the vulnerability discussed herein.[…]

https://siguza.github.io/IOHIDeous/
https://github.com/Siguza/IOHIDeous/blob/master/docs/index.md

https://github.com/Siguza/iokit-utils
https://github.com/Siguza/hsp4
https://github.com/Siguza/ios-kern-utils

efivalidate (and mojo_thor)

December 3, 2017 ~ hucktech ~ 1 Comment

Rick Mark has released efivalidate, a macOS-centric Ruby-based EFI checking tool. Also, by same author, Mojo_Thor project has activity. I thought it was a one-time drop, but it is actively being updated:

efivalidate is a ruby utility to take a given input EFI payload from macOS and to compare it against Apple’s validation schema. Being written in ruby this can occur off-box to ensure that the utility itself hasn’t been compromised

https://github.com/rickmark/efivalidate

Loki / Thor / Mojo are a triad of Apple internal tools and malware that infects the SMC, EFI and macOS of Apple MacBooks. It is believed that direct access to the hardware is gained by re-flashing the Thunderbolt controller (via ThorUtil)

https://github.com/rickmark/mojo_thor

https://rickmark.me/

Apple macOS High Sierra: can login as root with empty password!

November 28, 2017 ~ hucktech ~ Leave a comment

Dear @AppleSupport, we noticed a *HUGE* security issue at MacOS High Sierra. Anyone can login as "root" with empty password after clicking on login button several times. Are you aware of it @Apple?

— Lemi Orhan Ergin (@lemiorhan) November 28, 2017

You can access it via System Preferences>Users & Groups>Click the lock to make changes. Then use "root" with no password. And try it for several times. Result is unbelievable! pic.twitter.com/m11qrEvECs

— Lemi Orhan Ergin (@lemiorhan) November 28, 2017

To neuter this, I'd suggest:

sudo dscl . -passwd /Users/root $(uuidgen)

This will set root's password to a random string. Setting shell to /usr/bin/false does not block prefpane unlock. https://t.co/LJ8z1qgNSa

— Per Olofsson (@MagerValp) November 28, 2017

Reminder: if you need a complex password (say to set as a root password) you can use the Password Assistant via Sys Prefs -> Users & Groups -> Change Password… click key icon. Copy password, cancel password change. pic.twitter.com/PtXsM9d3W8

— Pepijn Bruienne 🌲🧀💴 (@bruienne) November 28, 2017

PSA: Have macOS High Sierra? Anyone can access your machine as root with no password – video demo below.

This is an OS default, so unless you set the password explicitly for root, you are vulnerable.

Fix this by setting a password for the root user!

Credit to @lemiorhan. pic.twitter.com/fGdA0bvNn2

— Den (@DennisCode) November 28, 2017

It looks like what's happening is that when you do this you're creating a root user with no password. Anyone who's tested this out should go disable the root user again in the Directory Utility ASAP.

— Amy Hailes (@a_hailes) November 28, 2017

liano: UEFI for macOS

November 16, 2017 ~ hucktech ~ Leave a comment

A miniemulator of UEFI firmware in Mac OSX.
I wanna create a emulator base on tiano UDK2015 which can be run in Mac OSX.

https://github.com/efikarl/liano

see-also:

https://github.com/efikarl/wiano

Intel open sources HAXM, Hardware Accelerated Executation Manager for Mac/Windows

November 16, 2017 ~ hucktech ~ Leave a comment

Intel HAXM (Qemu accelerator for Windows and MacOS) is now open source https://t.co/tqEQMtf6zs https://t.co/NMv8xf5O2L

— Frank Denis (@jedisct1) November 15, 2017

Intel Hardware Accelerated Execution Manager (HAXM)

HAXM is a hardware-assisted virtualization engine (hypervisor) that uses Intel Virtualization Technology to speed up IA (x86/ x86_64) emulation on a host machine running Windows or macOS. It started as an Android SDK component, but has recently transformed itself into a general accelerator for QEMU. HAXM can be built as either a kernel-mode driver for Windows or a kernel extension for macOS.[…]

https://github.com/intel/haxm

See-also:

https://01.org/android-ia/q-and-a/what-haxm

https://software.intel.com/en-us/articles/intel-hardware-accelerated-execution-manager-intel-haxm

https://github.com/Nukem9/Haxm

Trammell: eficheck finds Thunderstrike 2

November 6, 2017November 7, 2017 ~ hucktech ~ Leave a comment

Trammell Hudson tests Apple macOS’s eficheck against Thunderstrike2:

Sometime later today I'll be able to test @XenoKovah's efichecker tool… pic.twitter.com/mKCzdUEEc8

— Trammell Hudson ⚙ (@qrs) November 6, 2017

Success! Thunderstrike 2 was found by the efichecker, although it doesn't take any active steps to conceal itself. pic.twitter.com/Id6DaTRFfa

— Trammell Hudson ⚙ (@qrs) November 6, 2017

https://trmm.net/Thunderstrike
https://trmm.net/Thunderstrike_2
https://support.apple.com/en-us/HT207475

Thunderstrike 2

Apple macOS automatic EFI checks

September 24, 2017 ~ hucktech ~ Leave a comment

High Sierra automatically checks EFI firmware each week https://t.co/fv8kXhPu67 pic.twitter.com/YsdNkKp4DH

— Howard Oakley (@howardnoakley) September 24, 2017

RT @XenoKovah takeaway: eficheck is a the world's first stab at large-scale, privacy-preserving, x86 firmware integrity checking <- great!

— The Uninitialized Pointer Guru 🥇 (@osxreverser) September 24, 2017

High Sierra automatically checks EFI firmware each week

Upgrading to High Sierra brings a new and significant security feature: your Mac will automatically check its EFI firmware. In a series of tweets, Xeno Kovah, one of the three engineers responsible for the new tool, has outlined how this works.[…]

High Sierra automatically checks EFI firmware each week

AFAICT, the article references Tweets from earlier today that appear to have subsequently been deleted from Twitter.

new Apple tools: eficheck (and nvm)

August 31, 2017 ~ hucktech ~ 1 Comment

Apple has apparently created a tool for examining Apple Mac EFI firmware, called eficheck. As I understand things, it was released, then pulled due to some issues (bugs?), and is apparently now avabilable in latest macOS updates. Also, it sounds like there might be another tool for NVMe diagnostics.

It returned in 10.13 b5 after showing up on and off in earlier 10.12 betas: /usr/libexec/firmwarecheckers

— Pepijn Bruienne 🌲🧀💴 (@bruienne) August 14, 2017

nvm, seems to have been introduced at the same time as eficheck

— alex (@al3xtjames) June 13, 2017

usage: eficheck: [–save -b] [ –cleanup -b] [–generate-hashes [-b] [-p]] [–integrity-check [-h [-b]]] [–show-hashes [-h] | [-b]]

https://pikeralpha.wordpress.com/2017/08/18/apple-to-cleanup-a-bios-region-of-your-ami-and-phoenix-bios/
https://www.apple.com/macos/sierra/
https://en.wikipedia.org/wiki/MacOS_High_Sierra
https://www.macrumors.com/roundup/macos-10-13/
https://firmwaresecurity.com/2017/01/25/eficheck

Maybe someday there’ll be more info on eficheck, if you find any manpage or other info, please leave a Comment.
https://www.apple.com/us/search/eficheck
https://twitter.com/search?q=eficheck&src=typd

Mac’s Firmware Password

July 25, 2017 ~ hucktech ~ Leave a comment

Mac Observer has an article about Apple’s Firmware Password security feature:

Want to make your Mac more secure? Enable the firmware password #mac #security #tips https://t.co/7EhFtidmm7 pic.twitter.com/Jxpiw191s1

— The Mac Observer (@MacObserver) July 25, 2017

Firmware Password Utility shows password protection Enabled

https://www.macobserver.com/tips/quick-tip/macos-firmware-password/

Apple on Secure Kernel Extension Loading

July 25, 2017 ~ hucktech ~ Leave a comment

Onemoreadmin – Kextpocalypse – High Sierra and kexts in the Enterprise https://t.co/pSATFTzvIu

— macOS_adm (@macOS_adm) July 25, 2017

#macadmins – My thoughts on #kextpocalypse – #macadmin https://t.co/JDXsKE01bn

— Erik Gomez (@Contains_ENG) July 25, 2017

On June 19th, Apple released a document describing how loading secure kernel extensions (.kext) would change with High Sierra and how this would impact enterprise customers.[…]

System Extension Blocked

http://blog.eriknicolasgomez.com/2017/07/25/Kextpocalypse-High-Sierra-and-kexts-in-the-Enterprise/

https://developer.apple.com/library/content/technotes/tn2459/_index.html

OSX Book: Vol1 Update (and Vol3 on security)

July 19, 2017 ~ hucktech ~ Leave a comment

https://twitter.com/Morpheus______/status/884739050535624704

http://newosxbook.com/2ndUpdate.html

In addition to update of Vol1, I just noticed there’s a Volume 3 on security:
http://newosxbook.com/toc3.html

https://www.amazon.com/gp/product/0991055535/ref=as_li_tl?ie=UTF8&camp=1789&creative=9325&creativeASIN=0991055535&linkCode=as2&tag=newosxbookcom-20&linkId=da379822ff6f1352b5db7b25abb8a3c6

Dmytro on Apple PCI-E Thunderbolt

July 16, 2017 ~ hucktech ~ Leave a comment

SP605 fits just perfect into it's HighPoint Thunderbolt 2 enclosure 👌
Finally can check how good IOMMU is configured on Apple machines pic.twitter.com/h7dJ7wf6bD

— Dmytro Oleksiuk (@d_olex) July 15, 2017

An interesting finding while playing with PCI-E on OS X: different Thunderbolt devices can access the same DMA buffers mapped by IOMMU [1/2] pic.twitter.com/TbMSYhkl1F

— Dmytro Oleksiuk (@d_olex) July 15, 2017

It's HTTP traffic that going over my Thunderbolt to Ethernet adapter, it was intercepted by FPGA connected to other Thunderbolt port [2/2]

— Dmytro Oleksiuk (@d_olex) July 15, 2017

Yay, evil Thuderbolt device also can access I/O buffers of disk controller which talks to internal SSD of my MacBook Pro pic.twitter.com/nsqUJa6brN

— Dmytro Oleksiuk (@d_olex) July 15, 2017

By the way, I have enabled FileVault which encrypts that SSD, but rogue device somehow is able to see unencrypted filesystem data 😬 #wtf pic.twitter.com/VV6Qo0Y7Hn

— Dmytro Oleksiuk (@d_olex) July 15, 2017

This issue is confirmed for fully patched OS X Sierra, even physical locations of DMA buffers are the same [1/x]https://t.co/2tWLt3rZoD

— Dmytro Oleksiuk (@d_olex) July 16, 2017

OS X offers improper IOMMU support which isolates PCI-E devices from OS, but not from I/O buffers of each others [2/x]

— Dmytro Oleksiuk (@d_olex) July 16, 2017

So, evil PCI-E device can intercept and modify the data which going over your network card or disk controller [3/3] https://t.co/5D3zTcM9Os

— Dmytro Oleksiuk (@d_olex) July 16, 2017

Yes, boot chain level attack is related only for Macs because technically they doesn't have secure boot

— Dmytro Oleksiuk (@d_olex) July 16, 2017

Device still can poison the data of some binary, script or config file to gain code exec at OS level, FileVault doesn't helps

— Dmytro Oleksiuk (@d_olex) July 16, 2017

Setting up Mac for EFI development

July 11, 2017 ~ hucktech ~ Leave a comment

Setup EFI Development environment on Mac OSX Sierra (10.12.X) – https://t.co/b0eXPiEMWV #osx #uefi #programming #security

— Mikal/Meeh (@mikalv) July 11, 2017

Setup EFI Development environment on Mac OSX Sierra (10.12.X)

Mikal Villa Mikal Villa • 07/10/2017

Oh no! a lot of text. Well, luckly half of the post is troubleshooting. EFI development setup is easy 🙂

Okay, before starting this guide you should have some tools installed already.[…]

https://0xcc.re/setup-efi-development-environment-on-mac-osx-sierra-10-12-x/

macOS Security and Privacy Guide

April 2, 2017 ~ hucktech ~ Leave a comment

If you are have an Apple system, here’s a guide to hardening macOS. Unlike most hardening guides, this one covers some aspects of firmware. I wish each OS vendor maintained a document like this.

https://github.com/drduh/macOS-Security-and-Privacy-Guide#firmware