Getting a Migraine: Unique SIP Bypass on macOS
Discloses 'Migraine', a novel macOS System Integrity Protection (SIP) bypass vulnerability allowing root users to load unsigned kernel extensions.
Summary
The Security Boundary of macOS System Integrity Protection
System Integrity Protection (SIP) restricts root-level capabilities in macOS, preventing the modification of core system binaries, filesystem trees, and the loading of unsigned kernel extensions.
Reverse Engineering Apple Migration Assistant
Nir Even Or, Phil Pearse, and Ankur Bohra audit macOS system maintenance daemons, discovering critical logic oversights in how Apple's Migration Assistant executes elevated maintenance routines.
Bypassing SIP to Install Undeletable Malware
Exploiting the 'Migraine' vulnerability allows an attacker with root privileges to completely bypass SIP enforcement, modify protected directories, and load arbitrary kernel extensions.
Detection Strategies and Vendor Remediation
The researchers present behavioral detection heuristics for endpoint monitoring and review Apple's coordinated security patch.
Related talks
Main Stage·41 min
Patrick Wardle
macOS security expert Patrick Wardle exposes a local privilege escalation zero-day in Zoom for macOS, gaining root privileges by subverting the auto-updater.
Main Stage·40 min
Zhipeng Huo · Yuebin Sun · Chuanda Ding
Tencent Security researchers reveal novel IPC logic bugs in Apple's XPC messaging architecture, achieving privilege escalation and sandbox escape on macOS and iOS.
OffensiveCon·55 min
19-Eloi Benoist-Vanderbeken -macOS: How to Gain Root with CVE-2018-4193 in less than 10s.