Endpoint Security

RSS for tag

Develop system extensions that enhance user security using Endpoint Security.

Posts under Endpoint Security tag

200 Posts

Post

Replies

Boosts

Views

Activity

ESClient partitioning
My team has received a bit of instruction in the past about how to use ESClients for Endpoint Security tasks. The source suggested using multiple ESClients but not too many. I think the proposed limit was 40. The question is this: how can I determine what warrants a new ESClient? For example, consider an app that has 30 concurrent tasks of type A, a task of type B, a task of type C, and a task of type D. Should each task type gets its own ESClient? Should the tasks of type A be divided between multiple ESClients? Can you deliver any additional guidance on this?
1
0
585
Jun ’23
In macOS 10.15, double-click to start an app. ES_EVENT_TYPE_AUTH_EXEC event location where the app is located.
I encountered such a problem, when I am in macOS 10.15 this part, through monitoring ES_EVENT_TYPE_AUTH_EXEC ESF framework, if I double click on the start/Users/test/Downloads/test. The app, The path of test.app corresponding to message->event.exec.target-> Path. data in the ES_EVENT_TYPE_AUTH_EXEC event is under /private/var/folders. This prevents me from blocking the test.app startup in the /Users/test/Downloads/ directory through string matching.
1
0
1.1k
Jun ’23
Installing Network Extension drops ongoing connections
Hey all! I have a System Extension that, while doing some other things, starts up my custom Network Extension via [NEProvider startSystemExtensionMode]. This Network Extension contains a class (let's call it MyDataProvider) that overrides the NEFilterDataProvider interface and implements handleNewFlow. MyDataProvider thus acts as a network content filter. The problem is that installing my System Extension on a Ventura 13.4 (or older) system and starting up the Network Extension seemingly drops any ongoing connection I have. For example, my ssh connection will hang. This makes it quite annoying attempting to install the System Extension remotely. I do not see this behavior for my other class that inherits the NEFilterPacketProvider interface. Is this behavior expected of the NEFilterDataProvider? It seems like a bug since I do not see any documentation stating this behavior.
0
0
768
May ’23
Block ES_EVENT_TYPE_AUTH_CLONE event response, but NSFileManager copyItemAtPath: can still copy new files
I implemented a method to monitor the testfile copy activity and reject it using ES_EVENT_TYPE_AUTH_CLONE. The copy code used is as follows: NSFileManager *fileManager = [NSFileManager defaultManager]; NSError *error = nil; NSString *sourcePath = self.CopyFilePath.stringValue; NSString *destinationPath = [sourcePath stringByAppendingFormat:@"(Code copy file)"]; BOOL success = [fileManager copyItemAtPath:sourcePath toPath:destinationPath error:&error]; if (success) { NSLog(@"File copy successful"); } else { NSLog(@"File copy failure:%@", error.localizedDescription); } This code fires the ES_EVENT_TYPE_AUTH_CLONE event, and I treat the auth event as ES_AUTH_RESULT_DENY, but still create a new file testfile(Code copy file) How to prevent through code [fileManager copyItemAtPath: sourcePath toPath: destinationPath error: & error]; Implementation of the file copy
7
0
2.6k
May ’23
Endpoint Security and the system functionality
I am playing with endpoint security. I trying to implement block/allow user to read/write files on a USB media drive. I made my ep utility as launchctl daemon. I found that some applications couldn't start until I mute those processes for ep_client. Moreover, some system processes couldn't start until I mute messages from them. And even more, if my utility autoruns on system start, the clock on the top right corner of the screen may be absent. The Terminal app couldn't restore its state, it hangs on start. Actually, I came to that, my EP daemon should listen to very few processes. Those processes that can read/write files on USB media, and do it by user request. Or under user control. When KAUTH was not deprecated, I did it right in the kernel extension: if the vnode path is NOT on a removable drive, return DEFER at the beginning of callback. My question is: What processes are pure system? What system processes can read/write files for user or under user control? Does, for example, /usr/libexec/nsurlsessiond can download a file for user to the USB media?
2
0
1.4k
May ’23
Get process command line in Apple Endpoint Security Framework
I am writing a system extension and I want to get the command line. Back in kauth's days we used to get the csFlags and then the image_params, but I think that ES doesn't give us a pointer to the csFlags anymore. Tried like this: unsigned int csFlags = event->process->codesigning_flags; struct image_params* image = (struct image_params *)((char *) csFlags - __offsetof(struct image_params, ip_csflags)); But the csFlags is not a valid memory region.
1
0
1.1k
May ’23
How to observe one particular directory?
I created an ES Client, as I run it, it logs all the processes under /. So I add mute_path_prefix for those. I expect to see Notifications from /Users/anoopvaidya/, but it is not happening. What am I missing here? Any help, suggestions, guidance is highly appreciated. static void handleEvent(es_client_t *client, const es_message_t *msg) { char const *filePath = msg->process->executable->path.data; NSString *filePathString = [[NSString alloc] initWithFormat:@"%s", filePath]; os_log(OS_LOG_DEFAULT, "filePathString = %@", filePathString); } void mutePath(es_client_t *client) { os_log(OS_LOG_DEFAULT,"Adding muted files list"); NSArray<NSString *> *paths = @[ @"/Applications/", @"/bin/", @"/cores/", @"/Library/", @"/opt/", @"/private/", @"/sbin/", @"/System/", @"/usr/", @"/var/", ]; for (NSString *path in paths) { es_mute_path_prefix(client, [path UTF8String]); } } int main(int argc, char *argv[]) { // Create the client es_client_t *client = NULL; es_new_client_result_t newClientResult = es_new_client(&client, ^(es_client_t *c, const es_message_t *message) { handleEvent(client, message); }); if (newClientResult != ES_NEW_CLIENT_RESULT_SUCCESS) { return 1; } es_event_type_t events[] = { ES_EVENT_TYPE_NOTIFY_CREATE, //create file ES_EVENT_TYPE_NOTIFY_OPEN, // open file ES_EVENT_TYPE_NOTIFY_RENAME, // rename file ES_EVENT_TYPE_NOTIFY_CLOSE, // close file ES_EVENT_TYPE_NOTIFY_WRITE, // write to file ES_EVENT_TYPE_NOTIFY_UNLINK, // delete ES_EVENT_TYPE_NOTIFY_EXIT }; if (es_subscribe(client, events, sizeof(events) / sizeof(events[0])) != ES_RETURN_SUCCESS) { os_log(OS_LOG_DEFAULT, "Failed to subscribe to events"); es_delete_client(client); return 1; } mutePath(client); dispatch_main(); }
1
0
890
May ’23
Distribute network and endpoint system extensions through Mac App Store?
IIRC, when Apple introduced the new Network Extension and Endpoint Security system extension architectures, apps with Network Extensions in their bundle had to be distributed through the Mac App Store, whereas apps with Endpoint Security extensions could not be distributed through the Mac App Store (or vice versa). I can no longer find language on such restrictions. Can I distribute an app with both a Network Extension and an Endpoint Security extension in the same app bundle via the Mac App Store?
1
0
873
May ’23
Local UserNotification from Endpoint Security Extension
I'm working with a security extension on macOs. There are cases where the extension identifies or blocks some user activity. I would like to post a notification to the user via UNUserNotificationCenter. The extension itself is not running in an app bundle and receives an error that the system cannot resolve the app bundle proxy. To work around this restriction, I have created a separate helper app that can accept arguments and post user notification messages. I can call that app directly and display notification message. If I spawn that app with NSTask from a test command like executable, the app will display notifications. If I perform the exact same spawn from the security extension, the app does not have authorization to display. The error message retrieved when requesting authorization is "Couldn't communicate with a helper application." This error is coming from inside my helper application that was already spawned by the security extension and is in context of requesting authorization to post a user notification to UNUserNotificationCenter. The user has already approved the app to display notifications, the only thing different is spawning the app from the extension. Calling it from the command line or finder works just fine. https://developer.apple.com/documentation/usernotifications/asking_permission_to_use_notifications Before I try alternative designs.. Does anyone have insight to what is preventing the connection to user notification center in one deployment and not the other?
1
0
915
Apr ’23
Is it safe to use SecTranslocateCreateOriginalPathForURL?
I'm trying to keep track of some file information via Endpoint Security APIs. When I exec a file which is quarantined, the file is translocated to a different directory and the translocated path is what Endpoint Security shows (which makes sense because that's the path that's being executed). If that file is blocked due to XProtect, I get a message from XProtect via Endpoint Security saying that malware was detected and a path to the offending bundle. Unfortunately, the path is to the original bundle--not the translocated one--making it difficult to reconcile with the data collected above. I discovered a handy function, SecTranslocateCreateOriginalPathForURL, in Security frameworks which, given the translocated URL, will return the original URL. Works great. But there's no header for it. Is this safe to use, or do I have to do some other odd things to get the two to reconcile?
3
1
740
Apr ’23
trusting the team_id codesign naming scheme?
I have a question about the amount of trust I should have in the team_id for an executable. I've been looking at the signing_id and team_id values in Apple's endpoint es_process_t, and almost all code follows the reverse naming scheme for their team_id. They have names like: com.getdropbox.dropbox com.microsoft.teams.helper com.apple.mdworker_shared com.apple.spctl But Google (at least) violates this reverse DNS pattern when signing many of their binaries. They have team IDs such as ksfetch GoogleSoftwareUpdateDaemon crashpad_handler Should I not trust the TLD (e.g., com.apple or com.microsoft) for the team ID? For example, could Google (or a malicious organization) sign their binary com.microsoft.ksfetch making me think it came from Microsoft?
3
0
1.6k
Apr ’23
Couldnt generate ES_EVENT_TYPE_NOTIFY_AUTHENTICATION events with endpoint security
I wrote a program to receive the notify events from endpoint security framework. ES_EVENT_TYPE_NOTIFY_AUTHENTICATION event is not notified/logged in any scenario. Please help me with the information on when does mac generate or notify this event.
Replies
3
Boosts
0
Views
699
Activity
Jul ’23
Getting user data from lw_session_login event.
I wrote a program to receive the notify events from endpoint security framework. While logging into the workstation it generates ES_EVENT_TYPE_NOTIFY_LW_SESSION_LOGIN event. How to get the user id and other user info from this event.
Replies
1
Boosts
0
Views
600
Activity
Jul ’23
BSM audit can't work in macOS 14 Sonoma beta
Hi guys Following this topic : https://developer.apple.com/forums/thread/654443 I test this in macOS 14 beta, audit can't work now. Is it expected or a bug? If it is expected, is there any announcement ? Thank you! Command return error: sudo audit -i Error sending trigger: (ipc/send) invalid destination port
Replies
3
Boosts
0
Views
2.4k
Activity
Jun ’23
Endpoint Security Demo: 'System Extension' has been installed, but the service not start
I created a Endpoint Security the client, the System Extension have been normal load to/Library/SystemExtensions inside, and has been activated, but did not see the Extension to run, do you have who knows?
Replies
3
Boosts
0
Views
1.1k
Activity
Jun ’23
ESClient partitioning
My team has received a bit of instruction in the past about how to use ESClients for Endpoint Security tasks. The source suggested using multiple ESClients but not too many. I think the proposed limit was 40. The question is this: how can I determine what warrants a new ESClient? For example, consider an app that has 30 concurrent tasks of type A, a task of type B, a task of type C, and a task of type D. Should each task type gets its own ESClient? Should the tasks of type A be divided between multiple ESClients? Can you deliver any additional guidance on this?
Replies
1
Boosts
0
Views
585
Activity
Jun ’23
Can we use ESF without enrolling to Apple Developer Program?
Is it possible to use ESF framework without enrolling into Apple developer program? I wanted to try out ESF for learning purpose.
Replies
1
Boosts
0
Views
814
Activity
Jun ’23
In macOS 10.15, double-click to start an app. ES_EVENT_TYPE_AUTH_EXEC event location where the app is located.
I encountered such a problem, when I am in macOS 10.15 this part, through monitoring ES_EVENT_TYPE_AUTH_EXEC ESF framework, if I double click on the start/Users/test/Downloads/test. The app, The path of test.app corresponding to message->event.exec.target-> Path. data in the ES_EVENT_TYPE_AUTH_EXEC event is under /private/var/folders. This prevents me from blocking the test.app startup in the /Users/test/Downloads/ directory through string matching.
Replies
1
Boosts
0
Views
1.1k
Activity
Jun ’23
Pasteboard control when Ctrl + v
Can I control the pasteboard when user try to Ctrl + v? There's no option or related event in endpoint security. I'm came up the 'method swizzling', but it doesn't seem like a good way. Plz help me..
Replies
4
Boosts
0
Views
681
Activity
Jun ’23
Can I use the EndpointSecurity Framework to monitor USB device connections
I want to create a feature that monitors which USB devices my computer is using and lets me know what they are. If the USB storage device is connected to my MacOS device, I want to prevent it from being used. Is it possible to implement such a method using ESF framework? Or is there another way to do this?
Replies
0
Boosts
0
Views
967
Activity
May ’23
Installing Network Extension drops ongoing connections
Hey all! I have a System Extension that, while doing some other things, starts up my custom Network Extension via [NEProvider startSystemExtensionMode]. This Network Extension contains a class (let's call it MyDataProvider) that overrides the NEFilterDataProvider interface and implements handleNewFlow. MyDataProvider thus acts as a network content filter. The problem is that installing my System Extension on a Ventura 13.4 (or older) system and starting up the Network Extension seemingly drops any ongoing connection I have. For example, my ssh connection will hang. This makes it quite annoying attempting to install the System Extension remotely. I do not see this behavior for my other class that inherits the NEFilterPacketProvider interface. Is this behavior expected of the NEFilterDataProvider? It seems like a bug since I do not see any documentation stating this behavior.
Replies
0
Boosts
0
Views
768
Activity
May ’23
Block ES_EVENT_TYPE_AUTH_CLONE event response, but NSFileManager copyItemAtPath: can still copy new files
I implemented a method to monitor the testfile copy activity and reject it using ES_EVENT_TYPE_AUTH_CLONE. The copy code used is as follows: NSFileManager *fileManager = [NSFileManager defaultManager]; NSError *error = nil; NSString *sourcePath = self.CopyFilePath.stringValue; NSString *destinationPath = [sourcePath stringByAppendingFormat:@"(Code copy file)"]; BOOL success = [fileManager copyItemAtPath:sourcePath toPath:destinationPath error:&error]; if (success) { NSLog(@"File copy successful"); } else { NSLog(@"File copy failure:%@", error.localizedDescription); } This code fires the ES_EVENT_TYPE_AUTH_CLONE event, and I treat the auth event as ES_AUTH_RESULT_DENY, but still create a new file testfile(Code copy file) How to prevent through code [fileManager copyItemAtPath: sourcePath toPath: destinationPath error: & error]; Implementation of the file copy
Replies
7
Boosts
0
Views
2.6k
Activity
May ’23
Endpoint Security and the system functionality
I am playing with endpoint security. I trying to implement block/allow user to read/write files on a USB media drive. I made my ep utility as launchctl daemon. I found that some applications couldn't start until I mute those processes for ep_client. Moreover, some system processes couldn't start until I mute messages from them. And even more, if my utility autoruns on system start, the clock on the top right corner of the screen may be absent. The Terminal app couldn't restore its state, it hangs on start. Actually, I came to that, my EP daemon should listen to very few processes. Those processes that can read/write files on USB media, and do it by user request. Or under user control. When KAUTH was not deprecated, I did it right in the kernel extension: if the vnode path is NOT on a removable drive, return DEFER at the beginning of callback. My question is: What processes are pure system? What system processes can read/write files for user or under user control? Does, for example, /usr/libexec/nsurlsessiond can download a file for user to the USB media?
Replies
2
Boosts
0
Views
1.4k
Activity
May ’23
Get process command line in Apple Endpoint Security Framework
I am writing a system extension and I want to get the command line. Back in kauth's days we used to get the csFlags and then the image_params, but I think that ES doesn't give us a pointer to the csFlags anymore. Tried like this: unsigned int csFlags = event->process->codesigning_flags; struct image_params* image = (struct image_params *)((char *) csFlags - __offsetof(struct image_params, ip_csflags)); But the csFlags is not a valid memory region.
Replies
1
Boosts
0
Views
1.1k
Activity
May ’23
How to observe one particular directory?
I created an ES Client, as I run it, it logs all the processes under /. So I add mute_path_prefix for those. I expect to see Notifications from /Users/anoopvaidya/, but it is not happening. What am I missing here? Any help, suggestions, guidance is highly appreciated. static void handleEvent(es_client_t *client, const es_message_t *msg) { char const *filePath = msg->process->executable->path.data; NSString *filePathString = [[NSString alloc] initWithFormat:@"%s", filePath]; os_log(OS_LOG_DEFAULT, "filePathString = %@", filePathString); } void mutePath(es_client_t *client) { os_log(OS_LOG_DEFAULT,"Adding muted files list"); NSArray<NSString *> *paths = @[ @"/Applications/", @"/bin/", @"/cores/", @"/Library/", @"/opt/", @"/private/", @"/sbin/", @"/System/", @"/usr/", @"/var/", ]; for (NSString *path in paths) { es_mute_path_prefix(client, [path UTF8String]); } } int main(int argc, char *argv[]) { // Create the client es_client_t *client = NULL; es_new_client_result_t newClientResult = es_new_client(&client, ^(es_client_t *c, const es_message_t *message) { handleEvent(client, message); }); if (newClientResult != ES_NEW_CLIENT_RESULT_SUCCESS) { return 1; } es_event_type_t events[] = { ES_EVENT_TYPE_NOTIFY_CREATE, //create file ES_EVENT_TYPE_NOTIFY_OPEN, // open file ES_EVENT_TYPE_NOTIFY_RENAME, // rename file ES_EVENT_TYPE_NOTIFY_CLOSE, // close file ES_EVENT_TYPE_NOTIFY_WRITE, // write to file ES_EVENT_TYPE_NOTIFY_UNLINK, // delete ES_EVENT_TYPE_NOTIFY_EXIT }; if (es_subscribe(client, events, sizeof(events) / sizeof(events[0])) != ES_RETURN_SUCCESS) { os_log(OS_LOG_DEFAULT, "Failed to subscribe to events"); es_delete_client(client); return 1; } mutePath(client); dispatch_main(); }
Replies
1
Boosts
0
Views
890
Activity
May ’23
Distribute network and endpoint system extensions through Mac App Store?
IIRC, when Apple introduced the new Network Extension and Endpoint Security system extension architectures, apps with Network Extensions in their bundle had to be distributed through the Mac App Store, whereas apps with Endpoint Security extensions could not be distributed through the Mac App Store (or vice versa). I can no longer find language on such restrictions. Can I distribute an app with both a Network Extension and an Endpoint Security extension in the same app bundle via the Mac App Store?
Replies
1
Boosts
0
Views
873
Activity
May ’23
Local UserNotification from Endpoint Security Extension
I'm working with a security extension on macOs. There are cases where the extension identifies or blocks some user activity. I would like to post a notification to the user via UNUserNotificationCenter. The extension itself is not running in an app bundle and receives an error that the system cannot resolve the app bundle proxy. To work around this restriction, I have created a separate helper app that can accept arguments and post user notification messages. I can call that app directly and display notification message. If I spawn that app with NSTask from a test command like executable, the app will display notifications. If I perform the exact same spawn from the security extension, the app does not have authorization to display. The error message retrieved when requesting authorization is "Couldn't communicate with a helper application." This error is coming from inside my helper application that was already spawned by the security extension and is in context of requesting authorization to post a user notification to UNUserNotificationCenter. The user has already approved the app to display notifications, the only thing different is spawning the app from the extension. Calling it from the command line or finder works just fine. https://developer.apple.com/documentation/usernotifications/asking_permission_to_use_notifications Before I try alternative designs.. Does anyone have insight to what is preventing the connection to user notification center in one deployment and not the other?
Replies
1
Boosts
0
Views
915
Activity
Apr ’23
Is it safe to use SecTranslocateCreateOriginalPathForURL?
I'm trying to keep track of some file information via Endpoint Security APIs. When I exec a file which is quarantined, the file is translocated to a different directory and the translocated path is what Endpoint Security shows (which makes sense because that's the path that's being executed). If that file is blocked due to XProtect, I get a message from XProtect via Endpoint Security saying that malware was detected and a path to the offending bundle. Unfortunately, the path is to the original bundle--not the translocated one--making it difficult to reconcile with the data collected above. I discovered a handy function, SecTranslocateCreateOriginalPathForURL, in Security frameworks which, given the translocated URL, will return the original URL. Works great. But there's no header for it. Is this safe to use, or do I have to do some other odd things to get the two to reconcile?
Replies
3
Boosts
1
Views
740
Activity
Apr ’23
A mystery with the es_statfs_t online documentation
https://developer.apple.com/documentation/endpointsecurity/es_statfs_t It seems like the online documentation for es_statfs_t is based on the 32-bit statfs API while the 64-bit statfs API is actually used. Am I missing something?
Replies
1
Boosts
0
Views
784
Activity
Apr ’23
Lots of kmutil executions
I am seeing kmutil being executed a *lot* on my iMac with Big Sur. Apple's documentation says kmutil is used for loading and unloading kexts (and some other things). Should I be concerned with this much kmutil activity?
Replies
7
Boosts
0
Views
5.6k
Activity
Apr ’23
trusting the team_id codesign naming scheme?
I have a question about the amount of trust I should have in the team_id for an executable. I've been looking at the signing_id and team_id values in Apple's endpoint es_process_t, and almost all code follows the reverse naming scheme for their team_id. They have names like: com.getdropbox.dropbox com.microsoft.teams.helper com.apple.mdworker_shared com.apple.spctl But Google (at least) violates this reverse DNS pattern when signing many of their binaries. They have team IDs such as ksfetch GoogleSoftwareUpdateDaemon crashpad_handler Should I not trust the TLD (e.g., com.apple or com.microsoft) for the team ID? For example, could Google (or a malicious organization) sign their binary com.microsoft.ksfetch making me think it came from Microsoft?
Replies
3
Boosts
0
Views
1.6k
Activity
Apr ’23