University of Jyväskylä for the past 15 years. • Service developer at mcare pro Oy, Finland's leading Apple ICT consultancy. • Recovering musician... • I ❤ my wife and son (and Munki and AutoPkg)! 1 Transla)on for those who don't know Finnish: jyvä = grain, kylä = village. Yes, it's a small town...
security used to: • Iden&fy the source/origin (a developer or signer) of the code. • Guarantee that code has not been altered since it was signed. • Allow access to certain resources on the local computer without promp&ng the user.
issued by an authority who "vouches" for the holder. • They include informa;on about how to iden;fy the holder. • They cer;fy the iden;ty and na;onality of their holder.
care about the iden6ty of the signer. (Gatekeeper is a notable excep6on.) They care only whether the program is validly signed and stable. — Technical Note TN2206: macOS Code Signing in Depth
of the various parts of the code, created by the code signing so;ware. • Hash of hashes. • Individual checksums of executables, resources, Info.plist file, requirements, etc.
the rules governing verifica5on of the code signature. Some are inherent to the verifier (depending on its goals). Others are specified by the signer and sealed with the rest of the code.
cer)ficate chain. • anchor apple generic • Code signed by Apple, including code signed using a signing cer5ficate issued by Apple to other developers. • anchor apple • Apple's own code, signed by Apple. • anchor = <hash> • A specific cer5ficate hash.
apply for an Apple program to be able to issue passports which Apple vouches for. • CBP in every country especially likes these passports, they're easy to use and very secure. • There are some countries that have trouble issuing passports in the proper format. However, they are so important that CBP has received special instrucCons to allow them through. • Where a country does not recognise another, it may prohibit the use of their passport for travel to that other country.
from Apple VIP countries with a valid passport enter. Even if they're saying they are Adobe Flash Player but are not using a passport issued by Adobestan. • Once you get through the passport checks, CBP won't care about your passport. • You could always cross the border somewhere where CBP is not guarding.
should add a com.apple.quarantine extended a7ribute to the file. • Presence of this a7ribute will trigger a Gatekeeper check. • Think of it as a feature of the downloading app, system will not force the a7ribute on downloaded files.4 4 Download something with curl and see if Gatekeeper cares (it doesn't).
given. -v, --verbose Set the verbosity, add more v's to get more details. -r, --requirements During display, indicates where to write the code's internal requirements. Use -r- to write them to standard output.
a bundle, specifies that any nested code content will be recursively verified. --strict When valida+ng code, apply addi+onal restric+ons: • Check that symbolic links inside the code bundle point to sealed files inside its bundle. • Check that no resource forks, Finder a;ributes, or similar sideband data is present in the signed code.
Chrome.app: resource envelope is obsolete (custom omit rules) $ codesign --verify --deep --no-strict --verbose *Chrome.app Google Chrome.app: valid on disk Google Chrome.app: satisfies its Designated Requirement
using timestamp authority for signature productsign: signing product with identity "Developer ID Installer: Hannes Juutilainen" from keychain login.keychain-db productsign: adding certificate "Developer ID Certification Authority" productsign: adding certificate "Apple Root CA" productsign: Wrote signed product archive to munkitools_signed.pkg $ pkgutil --check-signature munkitools_signed.pkg Package "munkitools_signed.pkg": Status: signed by a certificate trusted by Mac OS X Certificate Chain: 1. Developer ID Installer: Hannes Juutilainen SHA1 fingerprint: E0 F3 42 86 16 1B 79 B3 CC 84 DB BB 8F 1E 03 1A F1 8F 67 21 ----------------------------------------------------------------------------- 2. Developer ID Certification Authority SHA1 fingerprint: 3B 16 6C 3B 7D C4 B7 51 C9 FE 2A FA B9 13 56 41 E3 88 E1 86 ----------------------------------------------------------------------------- 3. Apple Root CA SHA1 fingerprint: 61 1E 5B 66 2C 59 3A 08 FF 58 D1 4A E2 24 52 D1 98 DF 6C 60
the signature of a downloaded file. • Main idea is that we already know the designated requirement (DR) of an app from its previous version and use it to verify newly downloaded files. • The processor can also verify installer packages with pkgutil.
(Apple) • macOS Code Signing In Depth (Apple) • Gatekeeper Exposed (Patrick Wardle) • Code Signing – Hashed Out (Jonathan Levin) These will be clickable once you download the PDF slides...
hjuutilainen
sansan33
zaimy
sankichi92
mhlyc
ivry_presentationmaterials
gtnao
na0
shotatsuge
rsakata
x_ttyszk
sonatard
dougneiner
eileencodes
destraynor
tammyeverts
bermonpainter
vanstee
chrisshort
swwweet
jonrohan
bkeepers
sstephenson
![certificate leaf[field.1.2.840.113635.100.6.1.13] Checks the existance of certain fields in cer3ficates](https://files.speakerdeck.com/presentations/8a08bf57470741998d68549e6407f238/slide_19.jpg){kind=link}
![certificate leaf[subject.OU] = "8XXWJ76X9Y" Check the actual iden.ty of the](https://files.speakerdeck.com/presentations/8a08bf57470741998d68549e6407f238/slide_20.jpg){kind=link}
![$ codesign [ -d,--display | -v,--verify | -s,--sign ]](https://files.speakerdeck.com/presentations/8a08bf57470741998d68549e6407f238/slide_36.jpg){kind=link}
