Kobold: Evaluating Decentralized Access Control for Remote NSXPC Methods on iOS Luke Deshotels Costin Carabas, Jordan Beichler North Carolina State University, University POLITEHNICA of Bucharest North Carolina State University Samsung Research America [email protected] [email protected] [email protected] Razvan˘ Deaconescu William Enck University POLITEHNICA of Bucharest North Carolina State University [email protected] [email protected] Abstract—Apple uses several access control mechanisms to posed to other applications. However, several features (e.g., prevent third party applications from directly accessing secu- dynamic dispatching for method calls) make data flow rity sensitive resources, including sandboxing and file access analysis less practical for iOS binaries. To the best of our control. However, third party applications may also indirectly access these resources using inter-process communication (IPC) knowledge, there exists no systematic enumeration of iOS with system daemons. If these daemons fail to properly enforce remote methods accessible to third party applications. The access control on IPC, confused deputy vulnerabilities may closest related work is existing IPC fuzzers for iOS [2], result. Identifying such vulnerabilities begins with an enumer- [22], [30] that probe for code flaws such as type confusion ation of all IPC services accessible to third party applications. or dereferencing vulnerabilities, which can be exploited However, the IPC interfaces and their corresponding access control policies are unknown and must be reverse engineered at to obtain arbitrary code execution. However, these fuzzers a large scale. In this paper, we present the Kobold framework do not attempt to enumerate remote methods or identify to study NSXPC-based system services using a combination confused deputy vulnerabilities. From a policy perspective, of static and dynamic analysis. Using Kobold, we discovered SandScout [10] and iOracle [9] detect access control policy multiple NSXPC services with confused deputy vulnerabilities flaws in iOS; however, they are limited to the file system. and daemon crashes. Our findings include the ability to activate the microphone, disable access to all websites, and leak private iOS system daemons frequently protect IPC using static data stored in iOS File Providers. capabilities called entitlements, which are immutable key- value pairs bound to an executable’s code signature at Keywords-access control, iOS, iPhone, inter-process commu- nication, fuzzer, attack surface, automation, policy analysis compile time. To enforce access control policy on IPC, system daemons often use hard-coded conditional checks based on a caller’s entitlements. Unfortunately, there is I. INTRODUCTION limited understanding of IPC on iOS, despite the growing Apple’s iOS App Store offers over 2 million applica- amount of literature on iOS application [4], [8], [12], [19], tions [26], and in 2017 was used by half a billion customers [25], [29] and platform security [9], [10]. iOS defines several per week [27]. To protect users, third party applications run IPC interface abstractions, many of which exist for legacy within the confines of a sandbox that limits the number of reasons. The state-of-the-art interface type is called XPC.1 directly accessible resources. However, applications can also This paper focuses on the object-oriented version of XPC indirectly access sensitive resources through inter-process called NSXPC (Next Step XPC). Specifically, we seek communication (IPC) with system daemons. For example, an to answer: Which security and privacy sensitive NSXPC application does not have direct access to a user’s calendar, methods are accessible to third party applications? The but can use services provided by a calendar managing answer represents an attack surface of remote methods that daemon to view and modify calendar events. If a system may be exploited by third party apps through IPC. daemon does not properly enforce access control, a third- To answer this question, we address three research chal- party application may be able to abuse the daemon as a lenges. First, the set of entitlements available to third party confused deputy [20] to perform some action that damages applications is unknown. We identify two sets of entitle- the system or violates the user’s privacy. ments available to third party applications: a public set IPC-based confused deputy vulnerabilities are not new. accessible to all developers, and a semi-private set that Apple Woodpecker [17] uses data-flow analysis on pre-loaded Android applications to enumerate dangerous services ex- 1To the best of our knowledge, Apple has not expanded this acronym provides only to select developers. For example, the Uber not restricted to a specific version of iOS and can be used application was found to possess a potentially dangerous en- to study new versions as they are released. titlement normally unavailable to third party applications [6]. The remainder of the paper proceeds as follows. Section II Second, the set of NSXPC services accessible to third party provides background on iOS IPC and access control. Sec- applications is unknown. The executables that provide these tion III overviews Kobold. Section IV details the implemen- services are closed source and there is no centralized policy tation of Kobold. Section V presents the results of the semi- mapping services to their entitlement requirements. Third, private entitlement survey. Section VI quantifies the ports, which NSXPC services are security or privacy sensitive is methods, arguments, and entitlement requirements enumer- unknown. The semantics of these services are not publicly ated by Kobold. Section VII demonstrates Kobold’s ability documented, and data flow analysis in iOS is nontrivial. to detect previously unknown policy flaws and crashes. In this paper, we present the Kobold2 framework for Section VIII discusses limitations. Section IX overviews studying NSXPC services in iOS. Kobold leverages two related work. Section X concludes. key insights. First, the standardized IPC interfaces (e.g., NSXPC) contain predictable patterns in compiled code that II. BACKGROUND are identifiable via static analysis. Second, error messages iOS is Apple’s operating system for mobile devices (i.e., returned by unauthorized attempts to access IPC services can iPhone, iPad, iPod). It is very similar to macOS, watchOS, provide a model of the iOS IPC access control policy. Using and tvOS, which are all based on the XNU (X is Not Unix) these insights, Kobold provides a pattern-based, static binary kernel. XNU is a hybrid kernel that combines the Mach program analysis to enumerate NSXPC interfaces and then microkernel, FreeBSD, and a driver framework called I/O dynamically uses systematic probing to extract an approxi- Kit. Mach provides much of the Inter-Process Communica- mation of the access control policy encoded by conditional tion (IPC) functionality through mach-messages. FreeBSD checks within a given service. We used Kobold to study provides the file system and the TrustedBSD Mandatory iOS 9, 10 and 11 and found multiple NSXPC services with Access Control (MAC) Framework, which allows Apple confused deputy vulnerabilities and daemon crashes. The to hook system calls and implement sandboxing. Finally, discovered vulnerabilities allow third-party applications to as interfaces between user space and kernel space, I/O activate the microphone, disable access to all websites, and Kit drivers are often the target of fuzzing. The remainder leak private data stored in iOS File Providers. All issues of this section will explain Mach IPC and access control have been reported to Apple. At the time of writing, Apple mechanisms that regulate IPC on iOS. has provided two CVEs in response to our disclosure and is working to resolve remaining issues. After fixes are made, A. Mach IPC we plan to publicly release Kobold as open source code. This paper makes the following contributions: IPC on iOS is built upon the Mach microkernel. The • We present Kobold, the first framework for evaluating primitive components of Mach IPC are mach-messages NSXPC access control policies implemented in iOS and mach-ports. A service-providing process can host re- system code. Kobold enumerates the NSXPC services mote methods by registering a name for a mach-port, and accessible to third party applications and uses heuristics clients can send messages to that port in order to call to determine which services are likely to be exploited. the remote methods. The mach-port name registration is • We perform the first measurement of semi-private enti- facilitated by launchd, which also assists clients in con- tlements. We analyze approximately six thousand popu- necting to mach-ports. For example, the location daemon, lar third party applications and 100 thousand randomly locationd, offers remote methods on the mach-port named selected third party applications to determine which “com.apple.locationd.registration”. A client process can ac- semi-private entitlements Apple distributes to an undis- cess these methods by asking launchd to connect it to the closed subset of third party developers. “com.apple.locationd.registration” mach-port. If the connec- • We identify previously unknown security issues includ- tion is successful, the client can then send messages to the ing three categories of confused deputy vulnerabilities server via the mach-port. If the messages are well formed, and fourteen daemon crashes. Our findings include and the