Organizer
Partner Company
Package Disaster: Diving Deep into macOS PackageKit and Discovering 15+ New SIP-Bypass Vulnerabilities
Mickey Jin
Trend Micro
Abstract
MacOS Rootless, aka SIP (System Integrity Protection), is an essential security feature and the last line to protect the entire system from malware.
However, after I dived deep into the PackageKit framework, I found many new attack surfaces and disclosed 15+ critical logic vulnerabilities. They can be easily exploited to bypass SIP and compromise the system completely.
Apple had already addressed 13 of them as CVE-2022-22646, CVE-2022-22583, CVE-2022-26688, CVE-2022-22676, CVE-2022-22617, CVE-2022-26690, CVE-2022-26712, CVE-2022-26727, CVE-2022-32794, CVE-2022-32826, CVE-2022-32786, CVE-2022-32800 and CVE-2022-32900.
In this talk, I will share the details for half of them. I will talk about their root causes, how I exploited them, and how Apple addressed them. Finally, of course, I will also demonstrate the exploitations.
Speaker Info
Mickey Jin (@patch1t) works for Trend Micro as a security researcher with strong interests on malware analysis, threat campaign research and vulnerability research.
He has quite a lot of public reports for threat campaigns and vulnerabilities published in Trend Micro Research site.
He previously discovered the 0-days used by Mac Malware XCSSET and has been publicly credited for 80+ CVEs for his research on macOS/iOS and other platforms.