nmgycombinator

> I understand the technical reasons for that, but it is technically supported by the spec and other clients work with it just fine.

I am completely aware of that, but I am aware that other clients handle it just fine. The bug actually forced me to use a different client for when I actually needed an FTP client.

Take a look at it yourself if you're curious. The kernel code is open source: https://github.com/apple-oss-distributions/xnu

Oh fascinating. And it seems I had my terms confused. I didn't know the items themselves were called keychains.

> manually unlocked a local Keychain

Does the Keychain stay unlocked for a while? And do people actually do this?

> grep any user's FileVault password from the page file

I'm not sure if this necessitates physical access.

The PoC code should work. You just need to install Kass as a dependency. If you have done that, are there any other issues you are facing?

As far as risks are concerned: any app with the ability to get a send right to NetAuthAgent (pretty much any un-sandboxed app) can just silently as NetAuthAgent for any saved credentials for file drives (FTP, WebDAV, Samba, etc.), as well as chaining into a leak of all iCloud Contacts and Calendars (plus other stuff from iCloud). Sandboxing makes it difficult, but not impossible.

The risks are zero if you're up to date (and the patch was in October of last year, so you honestly should be up to date already). If you are not up to date for whatever reason and choose not to be, the risks are far more (unless you diligently check every single process that ever runs on your device).

A minor correction was made to the article:

Entitlement checks are not in the Mach layer of the kernel.

https://github.com/nmggithub/wts/commit/2bdce1c0c76c7adc360e...

Just a one word change, fixing a factual inaccuracy when talking about how XNU works.

I would argue that Mach was not the source of the bug here, but rather it was the lack of an entitlement check. Entitlements are honestly a very good security system, but they are opt-in. If a daemon doesn't check entitlements, then its insecure. Don't blame the messaging mechanism, blame the way it is used.

To be honest, any sort of locked down messaging system requires more (i.e. validation of sender, etc.) than just the transfer of messages. And that's just not something you would get with a low-level communication protocol like Mach (unless Apple overhauled the MIG compiler to add entitlement checks).

Mach is fantastic when paired with entitlement checks.

Damn, that's honestly hilarious.

Yeah, if you're writing user-facing apps, writing against Mach wouldn't be smart. But if you're a vulnerability researcher on the other hand... it's a neat trick and might just help you find a CVE! (even though most stuff has moved to XPC now and you could just used the public XPC API's there)

I feel like that (innocence about security) might be a bit of the reason why this vulnerability existed in the first place. I'm sure the NetAuthAgent code is very old, and was probably written at a time before even Apple was serious about security. And what really can you add new to a web server client? I wouldn't be surprised if the entitlement check is the first thing they've added to it in years.

It's funny, Apple themselves even suggest people use other apps for FTP: https://support.apple.com/guide/mac-help/servers-shared-comp...

> With read-only access, you can copy files from the server, but to copy files to the server, you may need another FTP app. Choose Apple menu  > App Store to find FTP apps available for macOS.

Another funny note: NetAuthAgent has had a bug for years where you cannot connect to an FTP server if your username contains an `@` symbol. I understand the technical reasons for that, but it is technically supported by the spec and other clients work with it just fine. I'd dig up some old posts talking about it going back years, but I don't want to put in the effort, lol.

> Interesting to see the port system mentioned - it's not a well known fact of Mach kernels.

I'm surprised to hear someone say that, given that it's the fact about Mach to me. I'm not sure how people could know about Mach but not its defining system.

Oh there's quite a lot of lore. Mach goes back even further to even earlier CMU kernel called Accent: https://en.wikipedia.org/wiki/Accent_kernel.