Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Validating Your Version of Xcode

developer.apple.com

Post reply on HN
Print view View original

1–10 of 101 posts

Re: Validating Your Version of Xcode

#2

Post by e28eta »

So, the next Trojan version of Xcode also needs to replace or corrupt spctl.

I should look at it (on iPad currently), but it seems like the right combination of a custom Certificate Authority added to the keychain and signing your malicious Xcode with a certificate signed by the CA would help. Maybe also change the quarantine metadata on the file?

Re: Validating Your Version of Xcode

#3

Post by pilif »

e28eta wrote: post #2

So, the next Trojan version of Xcode also needs to replace or corrupt spctl. I should look at it (on iPad currently), but it seems like the right combination of a custom Certificate Authority added to the keychain and signing your malicious Xcode with a certificate signed by the CA would help. Maybe also change the quarantine metadata on the file?

> seems like the right combination of a custom Certificate Authority added to the keychain and signing your malicious Xcode with a certificate signed by the CA would help

nope. Gatekeeper only accepts certificates issued by Apple. The trojan would have to patch gatekeeper itself which will be difficult once people upgrade to 10.11 and keep the System Integrity Protection enabled.

Even with all the bad feelings about Apple taking more and more control away from us, there's also a huge upside to this practice, I have to admit.

I guess as long as stuff is turnoffable in emergencies, I can live with the restrictions.

Re: Validating Your Version of Xcode

#4

Post by kitsunesoba »

e28eta wrote: post #2

So, the next Trojan version of Xcode also needs to replace or corrupt spctl. I should look at it (on iPad currently), but it seems like the right combination of a custom Certificate Authority added to the keychain and signing your malicious Xcode with a certificate signed by the CA would help. Maybe also change the quarantine metadata on the file?

That'd be fairly difficult under El Capitan as long as the user hasn't disabled rootless (even su/sudo can't modify system files with rootless on). Not sure about the signing part.

Re: Validating Your Version of Xcode

#5

Post by joosters »

e28eta wrote: post #2

So, the next Trojan version of Xcode also needs to replace or corrupt spctl. I should look at it (on iPad currently), but it seems like the right combination of a custom Certificate Authority added to the keychain and signing your malicious Xcode with a certificate signed by the CA would help. Maybe also change the quarantine metadata on the file?

I can't remember if Xcode asks for admin privileges or not when you install it...

...mind you, I guess that doesn't matter. If I unknowingly had a hacked version and it prompted me for my password at install, I would enter it.

Re: Validating Your Version of Xcode

#6

Post by devit »

e28eta wrote: post #2

So, the next Trojan version of Xcode also needs to replace or corrupt spctl. I should look at it (on iPad currently), but it seems like the right combination of a custom Certificate Authority added to the keychain and signing your malicious Xcode with a certificate signed by the CA would help. Maybe also change the quarantine metadata on the file?

One should of course verify its integrity BEFORE installing it and letting it replace spctl.

The real question is whether the spctl tool displays "Apple" in case of a valid (relative to generic CAs) certificate issued to "Apple". Hopefully that's not the case.

Another risk is a specifically designed executable capable of compromising spctl.

Re: Validating Your Version of Xcode

#7

Post by joosters »

kitsunesoba wrote: post #4
e28eta wrote: post #2

So, the next Trojan version of Xcode also needs to replace or corrupt spctl. I should look at it (on iPad currently), but it seems like the right combination of a custom Certificate Authority added to the keychain and signing your malicious Xcode with a certificate signed by the CA would help. Maybe also change the quarantine metadata on the file?

That'd be fairly difficult under El Capitan as long as the user hasn't disabled rootless (even su/sudo can't modify system files with rootless on). Not sure about the signing part.

Just put a copy elsewhere and surreptitiously edit PATH so that the malicious one gets picked first. No need to delete any files.

Re: Validating Your Version of Xcode

#9

Post by e28eta »

joosters wrote: post #5
e28eta wrote: post #2

So, the next Trojan version of Xcode also needs to replace or corrupt spctl. I should look at it (on iPad currently), but it seems like the right combination of a custom Certificate Authority added to the keychain and signing your malicious Xcode with a certificate signed by the CA would help. Maybe also change the quarantine metadata on the file?

I can't remember if Xcode asks for admin privileges or not when you install it... ...mind you, I guess that doesn't matter. If I unknowingly had a hacked version and it prompted me for my password at install, I would enter it.

I think it does, the first thing it needs to do is "Install Additional Components" (the updated mobile device framework)

Re: Validating Your Version of Xcode

#10

Post by misiti3780 »

joosters wrote: post #5
e28eta wrote: post #2

So, the next Trojan version of Xcode also needs to replace or corrupt spctl. I should look at it (on iPad currently), but it seems like the right combination of a custom Certificate Authority added to the keychain and signing your malicious Xcode with a certificate signed by the CA would help. Maybe also change the quarantine metadata on the file?

I can't remember if Xcode asks for admin privileges or not when you install it... ...mind you, I guess that doesn't matter. If I unknowingly had a hacked version and it prompted me for my password at install, I would enter it.

it does
Post reply on HN