HACKING A BRAND NEW MAC REMOTELY, RIGHT OUT OF THE BOX

APPLE'S SUPPLY CHAIN is one of the most closely monitored and analyzed in the world, both because of the control the company exerts and keen interest from third parties. But there's still never a guarantee that a mass-produced product will come out of the box totally pristine. In fact, it's possible to remotely compromise a brand new Mac the first time it connects to Wi-Fi.

That attack, which researchers will demonstrate Thursday at the Black Hat security conference in Las Vegas, targets enterprise Macs that use Apple's Device Enrollment Program and its Mobile Device Management platform. These enterprise tools allow employees of a company to walk through the customized IT setup of a Mac themselves, even if they work in a satellite office or from home. The idea is that a company can ship Macs to its workers directly from Apple's warehouses, and the devices will automatically configure to join their corporate ecosystem after booting up for the first time and connecting to Wi-Fi.

DEP and MDM require a lot of privileged access to make all of that magic happen. So when Jesse Endahl, the chief security officer of the Mac management firm Fleetsmith, and Max Bélanger, a staff engineer at Dropbox, found a bug in these setup tools, they realized they could exploit it to get rare remote Mac access.

"We found a bug that allows us to compromise the device and install malicious software before the user is ever even logged in for the very first time," Endahl says. "By the time they’re logging in, by the time they see the desktop, the computer is already compromised."

The researchers notified Apple about the issue, and the company released a fix in macOS High Sierra 10.13.6 last month, but devices that have already been manufactured and ship with an older version of the operating system will still be vulnerable. Bélanger and Endahl also note that Mobile Device Management vendors—third parties like Fleetsmith that companies hire to implement Apple's enterprise scheme—also need to support 10.13.6 to fully mitigate the vulnerability. Apple did not respond to WIRED's requests for comment.

The Setup
When a Mac turns on and connects to Wi-Fi for the first time, it checks in with Apple's servers essentially to say, "Hey, I'm a MacBook with this serial number. Do I belong to someone? What should I do?"

'If you’re able to set this up at the company level you could infect everybody.'

MAX BÉLANGER, DROPBOX

If the serial number is enrolled as part of DEP and MDM, that first check will automatically initiate a predetermined setup sequence, through a series of additional checks with Apple's servers and an MDM vendor's servers. Companies typically rely on a third-party MDM facilitator to navigate Apple's enterprise ecosystem. During each step, the system uses "certificate pinning," a method of confirming that particular web servers are who they claim. But the researchers found a problem during one step. When MDM hands off to the Mac App Store to download enterprise software, the sequence retrieves a manifest for what to download and where to install it without pinning to confirm the manifest's authenticity.

If a hacker could lurk somewhere between the MDM vendor's web server and the victim device, they could replace the download manifest with a malicious one that instructs the computer to instead install malware. Architecting such an elaborate man-in-the-middle attack would be too difficult or expensive for the average web criminal, but well-funded and driven hackers could manage it. The tainted download server would also need to have a valid web certificate, another hurdle that makes the attack harder but certainly not impossible. From there, attackers could install anything from spyware to cryptojacking software on vulnerable Macs. They could even plant a malicious tool that evaluates devices on a corporate network to find vulnerable systems it can spread to. And once a hacker has set up the attack, it could target every single Apple computer a given company puts through the MDM process.

"One of the aspects that’s scary about this is if you’re able to set this up at the company level you could infect everybody depending on where you do the man-in-the-middle," Bélanger says. "This all happens very early in the device’s setup, so there aren’t really restrictions on what those setup components can do. They have full power, so they’re at risk of being compromised in a pretty special way."

Hard Target
Bélanger and Endahl stress that the attack isn't easy. They can only demonstrate a version of it at Black Hat because Endahl works at Fleetsmith, and can set up the certified server and the man-in-the-middle attack on the MDM vendor himself. And they praise Apple's application security and the MDM process overall, noting that Apple has already created the ability to kill malicious apps once the company discovers them.

But they emphasize that it would be possible for a well-funded, motivated attacker to exploit the flaw if they were looking for a way onto Macs. And the potential to use the attack as a jumping off point to bore deeper into corporate networks would have plenty of appeal. Hackers could even simplify the attack by targeting employees who work from home and are easier to man-in-the-middle, thanks to their consumer-grade routers.

"The attack is so powerful that some government would probably be incentivized to put in the work to do it," Endahl says.

Apple's patch will proliferate quickly to negate the flaw, but it's a good reminder regardless that even minute weaknesses in an ecosystem as elaborate as Apple's can have potentially serious consequences.