Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2506 Thanks!
[Music]
so um next to me we have Ryan hermans so
he is uh yeah security uh engineer at um
at tret tret tret sorry um but I think
you will give some introduction to
yourself um yeah right now it's about um
the fox U for Fox sake um by passing
Enterprise policy and Firefox so yeah
looking forward to your talk right now
thank
you
[Applause]
uh hello hello uh my name is Ryan uh
just a couple things about me um I work
as a security engineer for Chinet zenitz
uh I'm very driven by curiosity which I
imagine most of you might be able to
identify with um my first introduction
to cyber security was when my parents
put a password on the family computer
which myself and my brother found
intolerable um I very much enjoy gelato
and if you need to reach me at this
event I'm available on Matrix at or10
Technics
dode uh to Jump Right In um there was a
bit of a problem at my company where
there was Enterprise policy that was
pushed to some of the computers without
consulting the entire company and
people's workflows and some users had
been disrupted by this and were somewhat
irritable uh and I kept hearing some
discussion of circumventing the policy
and as a security engineer it's part of
my job to make sure that the policy is
enforced um so I just asked myself the
question how easy would it be for a
privileged user to bypass this
Enterprise policy control uh and
unfortunately the answer is um if you
have some level of administrative access
quite easy um so I would like to temper
your expectations this is not uh a crazy
exploit or something that you can do
without having some level of privilege
to access uh root user or uh the ability
to edit the applications directory um of
course if you had access you could do
something much nastier to the system I'm
sure uh to start out uh when our users
um I don't know how well you could see
that but uh when our users opened
Firefox and open the menu uh off to the
right um they noticed something was
missing um the Incognito or in private
um tabs
option um so first step uh we go in
Firefox into about colon policies to see
and we see yes the Enterprise policy
service is active
um we see several things being imported
as well as disabled private browsing is
true uh
so the first uh way we might be able to
tack this is to look at the actual
profile system on it's being loaded onto
the computer um Mac OS uh profiles are
similar to active directory uh it would
be loaded using an MDM uh system the
policy would be pushed to the host and
then thereafter uh the policy would be
served using the profile service and the
applications would query uh this service
um um so we ask oursel can we modify
this profile that's actually installed
on the machine um so to start we open a
root terminal and we run profiles list
we see there are many many profiles
loaded on the machine about 87 on this
machine I was testing on um so then we
take a closer look uh using profile show
and to make our life easy we'll use grep
and grep for Fox ah Bingo we see a
profile that is conveniently named uh
Firefox incognito mode disable so this
is is our primary target um you could
try to unload them directly uh I went to
the actual database uh and that's at
vdbc configuration profiles and I said
you know just like active directory and
editing the registry Hive directly maybe
I can just reach into the database
change the values um we take a look at
this uh folder we take a look at a
detail and all of a sudden we have a
problem operation not permitted so you
might ask well I'm root why is this
operation not permitted uh We've run
into something called system Integrity
protection um it's a system uh on Mac
computers that such that there's a user
more powerful than the root user and
some things just simply cannot be
tampered with so we're just going to
call this a dead end but that's okay
because at some point Firefox has to be
loading the actual policy and then it's
it's outside of the realm of sip so we
look at Firefox and we say where does it
load this policy um and is it easily
accessible can we change it um a lot of
Firefox actually works through
JavaScript modules perhaps this
functionality is contained within a
JavaScript module that we can just
directly
edit uh this introduces us to our second
friend uh the browser console with
command shift J if we load that we get
to see everything happening inside
Firefox um and then our second friend
about. config because we want to see
much more information in the console so
we'll go to about colon config we get a
nice scary warning you say accept uh and
then we punch in a new policy browser.
policies. log
level click string click add type in
debug to set our policy log level to
debug and print more uh information out
for
us uh now when we go back to the browser
console and reload Firefox we see much
much more information everything that
happens on
Startup and most importantly at the
bottom we see Mac OSS policy parser JSM
and we see all the information it's
loading so pretty quickly we've
determined yes uh this whole management
of Enterprise policies is happening
within one of these JavaScript
modules um hopefully Firefox uh
indicates for us uh a exact line number
and gives us a link that we can click to
directly take us to the source code for
Firefox and uh we immediately identify a
function where it is parsing these
policies cleans them up and then returns
them uh and so that perhaps will give us
a Target to
attack
so for the actual bypass we now know
where Firefox is handling this policy uh
we just don't know where it is in the
file system uh and we don't know if we
can update this module or if we can
reload this module into Firefox without
it
complaining uh so we open up a new root
shell uh we navigate to the applications
Firefox app directory um and then we run
a find command we don't see anything
that's fine uh let's use GP ah all of a
sudden we see a couple options uh it
shows up in two files both named Omni
Doja uh to keep this talk a little
shorter I'm just going to say that we're
going to focus on the very first
one um we can take this copy it to ATT
temp
directory and then unzip it and we see a
ton of things roll out of that that's
quite fine um we're going to remove the
original clean up a little bit and take
a look in this directory and we see uh
all sorts of extensions to Firefox
including a very interesting modules
folder if we run that find a command
again we are richly rewarded uh we see
modules policies Macos policy parser
dos.
MJS uh this will be what we will be
trying to
adjust um so if we load up less to take
a look at the
file we
see we can scroll down and we find the
exact same function that Firefox pointed
out to us in the debug options this is
what we'll try to
change
so uh at the tail end of this it says
return native policies perhaps we'll
just try to change this singular line if
we go back to a root terminal we'll use
said and we replace uh return native
policies with return
null after we make that edit and we
reload the file we can see that that
line has been updated to return null now
we have to repack and reinstall these
changes into Firefox uh you can do that
uh using the zip command uh
unfortunately this is a bit of a magic
string there was some trial and error on
this uh Firefox kept crashing unless
it's this Omni Doja file is repacked in
a very specific way um but we reload
that and we copy it back in and that's
really all there is to it and suddenly
uh oh sorry one more bit of magic um
Firefox um you have to add this purge
caches file so it will reload everything
from the Omni Doja file uh if you don't
do that um your changes won't really
sink into the rest of Firefox um add
that we go back to a browser console and
we see the same things we see the policy
being loaded and it printing it out
right before it returns it but then all
of a sudden we go to our about policies
and we find the Enterprise policy
Services completely inactive as if
nothing ever happened it got the policy
from the service it was logged that it
got the policy from the service uh but
it never actually did anything with it
um and if we open our hamburger menu and
we look on the right we see our new
private window option has been returned
to us um so some thank you thank
[Applause]
you some very quick
conclusions um open source tools are
awesome they can very easily be extended
or changed sometimes there's very good
documentation for them um but generally
they're built in a way way such that
they can be improved Firefox is no
exception to that um the trouble with
this implementation and using a
JavaScript module for this handling is
that this policy service can be very
easily blanked as I did uh as an
exercise to The Listener you could
potentially inject malicious policy set
up proxies um load um Firefox extensions
uh there are many things you could do
with this um so applications that load
security functions uh they probably
should have some sort of protection for
this code uh as far as I could
tell Firefox wasn't validating the Omni
Doja file or checking for changes to it
and as far as I could tell in the
security tools for my company uh our EDR
and MDM tools were also not checking
this file uh just the main Firefox
binary uh so none of this was detected
at all um lastly get your Incognito tabs
back I can't uh exactly uh condone a
violation of Enterprise policy but
sometimes uh privacy is
good uh that's all I have for you uh
very quick uh thank you all for
[Applause]
listening so thank you very much for the
talk pretty interesting I hope also for
the folk over here um yeah I think we
have more than enough time for questions
so um please um maybe we can start with
some question from the internet so are
there some
sure there is a question uh did you
report this issue to Firefox and what
happened uh a little louder did you uh
report this issue to Firefox directly to
moella uh I have not reported this to
Mozilla um it seems to be a very minor
problem and perhaps is is working as
intended um Firefox is not a a browser
meant for Enterprise management um
okay okay thank you so we have another
question over here um hello hello
um do your users not have the ability to
turn off sep entirely anyway um like
reboot into recovery mode and and G
access I'm so glad you brought that up
uh I actually skipped over that in my
notes um your users did have the ability
to turn off system Integrity protection
but in this use case uh we're pretending
that the user is trying to bypass
controls and they presumably don't want
to be detected uh turning off system
Integrity protection is like waving a
giant red flag and saying I've
compromised my own machine and would be
uh very quickly detected by it teams but
thank
you howy I'm also a security engineer at
a company that has decided to push
profiles to the browsers disabling um
not only mode but also like editing Vie
your own cookies and stuff like that we
unfortunately are use Chrome and I
actually did went down this exact same
path but with Chrome and I found just
sharing um uh if you on that uh like the
V DB path you can create a you can mount
you create an empty file system image
mount it over that and they all just
disappear you don't have to any no
privileges at all um alternatively also
use like something like LD preload or
the Mac equivalent and just change um
the CIS call responses that's very
clever I use that with chrome because
that's more like closed Source but
hacking um modifying the Firefox is
pretty cool too very very clever but uh
if you were to mount that empty
directory didn't it wipe out all
Enterprise policy on the machine yes ooh
dangerous thank you for sharing so okay
another over here
fun Al there sports activity over
here thank you for the presentation um
the files you modified were they in the
application data or in the user home
directory Firefox profile these were in
the application data thank
[Music]
you his mic isn't on oh no yeah thank
you for talk very interesting um you
said that like code Integrity checks
would would be helped to fix the
situation but uh a user with some
administra administrative level access
could also just bypass those
verification checks like where do you
draw the line where what an
administrative uh administrative user
should be able to do and what not
because like you are already
privileged uh you make an interesting
point um I would hope at least to
maintain some level of Integrity that
Firefox would perhaps sign this file uh
or check that signature in the binary
just is something to make sure just a
little make it a little bit more
difficult you're correct though like at
some level when you have administrative
access there is something you can do
always um as even this gentleman
mentioned you can blank all the policies
on your machine U by mounting an empty
directory at that location
um we could have a rabbit hole all day
about where is the line I don't know
where it should
be okay so some other questions you
would like to
ask oh over there hey um so as you said
a privileged user I mean if you have
root you can do anything um typically at
least at our place when when they push
out dystopian policies you don't have
root so what's the minimum you know do
you have any ideas or I mean it's a
rabbit hole now but
um any any tricks um in that direction
that you could think of um that you
could do as a user without root
taes
um not that I had necessarily explored
um most of the users had some level of
local administrative access so that was
kind of my environment that I was
working in I didn't explore from the
perspective of a non-privileged user um
perhaps we can talk afterwards and maybe
someone else has a good
idea yes thank
you so somebody else
no also I think we do not have anyone in
the fediverse so far so
then I think we can give a warm and
grateful Applause again to Ryan and
[Music]
yeah