Mac OS X and Ios Zero- Day Exploit

Home , Privilege escalation

Mac OS X and iOS Zero- Day Exploit

Security Advisory AE-Advisory 16-08 Criticality High Advisory Released On 28 March 2016

Impact

Allows someone to escalate privileges and also to bypass system integrity

Solution

See the solution section below for mitigation processes.

Affected Platforms

 Mac OS X 10.11.3 and older, iOS 9.2 and older

Summary aeCERT has researched and found out about a new threat on Apple Mac OS X and iOS; with the release of OS X El Capitan, Apple introduced a security protection feature to the OS X kernel called System Integrity Protection (SIP).

The feature is designed to prevent potentially malicious or bad software from modifying protected files and folders on your Mac.

The purpose of SIP is to restrict the root account of OS X devices and limit the actions a root user can perform on protected parts of the system in an effort to reduce the chance of malicious code hijacking a device or performing privilege escalation.

However, it has been uncovered a critical vulnerability in both OS X and iOS that allows for local privilege escalation as well as bypasses SIP without karnel exploit impacting all versions to date.

Threat Details

The zero day vulnerability is a Non-Memory Corruption bug that allows hackers to execute arbitrary code on any targeted machine, perform remote code execution (RCE) or sandbox escapes.

The attacker then escalates the malware's privileges to bypass System Integrity Protection SIP, alter system files, and then stay on the infected system.

By default, System Integrity Protection or SIP protects these folders:

 /System.  /usr.  /bin.  /sbin.

Along with applications that come pre-installed with OS X.

Solution

Although the zero-day vulnerability was discovered in early 2015 and was reported to Apple in January this year, the good news is that the bug doesn't seem to have been used in the wild.

Apple has patched the vulnerability, but only in updates for El Capitan 10.11.4, and iOS 9.3 that were released on 21st March.

Other versions do not appear to have a patch update for this specific vulnerability from Apple, meaning they are left vulnerable to this specific zero-day bug.

Tel (+971) 4 230 0003 Fax (+971) 4 230 0100 Email info[at]aeCERT.ae

For secure communications with aeCERT with regards to sensitive or vulnerability information please send your correspondences to aeCERT[at]aeCERT.ae