Skip to main content
HDWSec
Low CVE-2020-24003

Skype for macOS Unsigned Shared Library Injection (Unprompted Microphone & Camera Access)

Severity
Low
CVSS score
3.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVE number(s)
CVE-2020-24003
Vendor
Microsoft
Product
Skype for macOS
Affected version(s)
Skype for macOS through 8.59.0.77 (tested on macOS Catalina 10.15.3)
Fixed version(s)
Fix integrated by Microsoft on 2020-05-18 (exact build not specified)
Vulnerability type
Shared Library Injection / Dylib Hijacking (CWE-427: Uncontrolled Search Path Element)
Researchers
Jean-Jamil KHALIFÉ

Presentation

Skype is one of the most widely used video conferencing applications, both professionally and personally, which makes it an attractive target for malware. On macOS, Skype (version 8.59.0.77 and earlier) is compiled with the Hardened Runtime, a protection intended to prevent code injection into a running process.

However, Skype ships with the com.apple.security.cs.disable-library-validation entitlement. This entitlement disables the library validation that the Hardened Runtime normally enforces, so a local process running with the user’s privileges can load a crafted, unsigned shared library into Skype. Because Skype already holds the camera and microphone entitlements (and the user has typically granted those permissions once at first use), the injected library inherits unprompted access to the microphone and camera.

Issue(s)

  • Skype for macOS is signed with the com.apple.security.cs.disable-library-validation entitlement, which defeats the anti-injection protection provided by the Hardened Runtime and allows loading an unsigned shared library.
  • Skype holds the com.apple.security.device.camera and com.apple.security.device.audio-input entitlements. Once the user grants camera/microphone access, that access is available to the application (and therefore to any injected code) on every launch.
  • One of Skype’s linked dependencies (the Electron Framework library) resides inside the Skype directory, at a location writable by the user. This makes it possible to replace or proxy the library and have the application load attacker-controlled code.
  • Combined, these conditions let a local process obtain unprompted microphone and camera access by injecting a crafted library that inherits Skype’s media permissions.

Full technical analysis

The complete write-up (root cause, exploitation, proof of concept) is available on the HDW Sec blog: https://www.hdwsec.fr/blog/20200608-skype/

References

Our R&D hunts for vulnerabilities.

Zero-day research, reverse engineering, coordinated disclosure: discover our R&D team.

Discover our R&D All publications