Attack Chain

1. The attacker identifies a vulnerable application using tools like Dylib Hijack Scanner (DHS), looking for apps with weak or rpath-dependent dylib loading.
2. The attacker confirms the absence of library-validation option (flag=0x200) using codesign to verify if dylib hijacking is possible.
3. The attacker crafts a malicious dylib (e.g., hello-tresorit.dylib) containing code to be executed upon loading, such as opening a Terminal or creating a syslog entry.
4. The attacker uses gcc to compile the dylib. The attacker uses a tool like createHijacker.py to fix the dylib version and add exports from the original dylib to the malicious dylib.
5. The attacker exploits a vulnerability to bypass root folder permissions to copy the malicious dylib to the application’s framework directory (e.g., /Applications/Tresorit.app/Contents/MacOS/TresoritExtension.app/Contents/PlugIns/FinderExtension.appex/Contents/MacOS/../../../../Frameworks/UtilsMac.framework/Versions/A/UtilsMac).
6. The attacker launches the targeted application, causing the malicious dylib to be loaded into the application process.
7. The malicious code within the dylib executes with the privileges of the application, potentially escalating privileges to root.
8. The attacker achieves persistence or performs other malicious actions based on the gained privileges.

Impact

Successful exploitation of this vulnerability can lead to complete system compromise. An attacker gaining root access can install persistent backdoors, steal sensitive data, or deploy ransomware. The number of potential victims is large, as many macOS applications from the App Store are vulnerable. The affected sectors span various industries, as the vulnerability affects a wide range of applications. The consequences of a successful attack range from data breaches and financial loss to complete system control by the attacker.

Recommendation

• Use a tool like Dylib Hijack Scanner to identify vulnerable applications in your environment and prioritize patching or removal.
• Monitor for the creation of new dylibs within application framework directories, which may indicate a dylib hijacking attempt, using a file integrity monitoring system.
• Deploy the Sigma rule Detecting Dylib Hijacking via DYLD_PRINT_RPATHS to detect attempts to identify vulnerable dylibs.
• Enable library validation for applications to prevent the loading of unsigned or improperly signed dylibs.
• Use process monitoring tools like Objective-See’s ProcInfo to detect suspicious process creation events that may be indicative of exploitation.