Skype for macOS Unsigned Shared Library Injection (Unprompted Microphone & Camera Access)

Presentation

Skype is one of the most widely used video conferencing applications, both professionally and personally, which makes it an attractive target for malware. On macOS, Skype (version 8.59.0.77 and earlier) is compiled with the Hardened Runtime, a protection intended to prevent code injection into a running process.

However, Skype ships with the com.apple.security.cs.disable-library-validation entitlement. This entitlement disables the library validation that the Hardened Runtime normally enforces, so a local process running with the user’s privileges can load a crafted, unsigned shared library into Skype. Because Skype already holds the camera and microphone entitlements (and the user has typically granted those permissions once at first use), the injected library inherits unprompted access to the microphone and camera.

Issue(s)

• Skype for macOS is signed with the com.apple.security.cs.disable-library-validation entitlement, which defeats the anti-injection protection provided by the Hardened Runtime and allows loading an unsigned shared library.
• Skype holds the com.apple.security.device.camera and com.apple.security.device.audio-input entitlements. Once the user grants camera/microphone access, that access is available to the application (and therefore to any injected code) on every launch.
• One of Skype’s linked dependencies (the Electron Framework library) resides inside the Skype directory, at a location writable by the user. This makes it possible to replace or proxy the library and have the application load attacker-controlled code.
• Combined, these conditions let a local process obtain unprompted microphone and camera access by injecting a crafted library that inherits Skype’s media permissions.

Full technical analysis

The complete write-up (root cause, exploitation, proof of concept) is available on the HDW Sec blog: https://www.hdwsec.fr/blog/20200608-skype/

References

• HDW Sec blog: https://www.hdwsec.fr/blog/20200608-skype/
• CVE-2020-24003 (NVD): https://nvd.nist.gov/vuln/detail/CVE-2020-24003