Abstract: On modern operating systems, applications under the same user are separatedfrom each other, for the purpose of protecting them against malware andcompromised programs. Given the complexity of today's OSes, less clear iswhether such isolation is effective against different kind of cross-appresource access attacks (called XARA in our research). To better understand theproblem, on the less-studied Apple platforms, we conducted a systematicsecurity analysis on MAC OS~X and iOS. Our research leads to the discovery of aseries of high-impact security weaknesses, which enable a sandboxed maliciousapp, approved by the Apple Stores, to gain unauthorized access to other apps'sensitive data. More specifically, we found that the inter-app interactionservices, including the keychain, WebSocket and NSConnection on OS~X and URLScheme on the MAC OS and iOS, can all be exploited by the malware to steal suchconfidential information as the passwords for iCloud, email and bank, and thesecret token of Evernote. Further, the design of the app sandbox on OS~X wasfound to be vulnerable, exposing an app's private directory to the sandboxedmalware that hijacks its Apple Bundle ID. As a result, sensitive user data,like the notes and user contacts under Evernote and photos under WeChat, haveall been disclosed. Fundamentally, these problems are caused by the lack ofapp-to-app and app-to-OS authentications. To better understand their impacts,we developed a scanner that automatically analyzes the binaries of MAC OS andiOS apps to determine whether proper protection is missing in their code.Running it on hundreds of binaries, we confirmed the pervasiveness of theweaknesses among high-impact Apple apps. Since the issues may not be easilyfixed, we built a simple program that detects exploit attempts on OS~X, helpingprotect vulnerable apps before the problems can be fully addressed.

References & Citations