Organizer
Partner Company
Apple Disk-O Party
Csaba Fitzl
Kandji
Abstract
In this talk I will share the details about four different vulnerabilities all related to disks. We will start by understanding how the diskarbitrationd system daemon works, what preventive measures it has. Then I will go through sandbox escape and full TCC bypass vulnerabilities impacted this daemon. Then we will move on to a new field and talk about diskutil, and storagekitd - what they are and what they can be used for. Once we are familiar with the tools I will detail several vulnerabilities, including full TCC bypasses and privilege escalations. Finally we will divert to diskutil's big brother, Disk Utility. There I will show how someone can use that to elevate privileges from admin to root if GUI access is available, for example in unattended workstations.
Speaker Info
Csaba Fitzl graduated in 2006 as a computer engineer. He worked for 6 years as a network engineer, troubleshooting and designing big networks. After that, he worked for 8 years as a blue and red teamer focusing on network forensics, malware analysis, adversary simulation, and defense bypasses. Then he moved on to the macOS world and developed a "macOS Exploitation and Penetration Testing" training at OffSec. Currently he works as a Principal macOS Security Researcher at Kandji. He gave talks and workshops at various international IT security conferences, including Hacktivity, BlackHat, Troopers, SecurityFest, DEFCON, and Objective By The Sea. Csaba spends his free time with his family, hikes and runs in the mountains.