Adversaries may leverage the <code>AuthorizationExecuteWithPrivileges</code> API to escalate privileges by prompting the user for credentials.(Citation: AppleDocs AuthorizationExecuteWithPrivileges) The purpose of this API is to give application developers an easy way to perform operations with root privileges, such as for application installation or updating. This API does not validate that the program requesting root privileges comes from a reputable source or has been maliciously modified.
Although this API is deprecated, it still fully functions in the latest releases of macOS. When calling this API, the user will be prompted to enter their credentials but no checks on the origin or integrity of the program are made. The program calling the API may also load world writable files which can be modified to perform malicious behavior with elevated privileges.
Adversaries may abuse <code>AuthorizationExecuteWithPrivileges</code> to obtain root privileges in order to install malicious software on victims and install persistence mechanisms.(Citation: Death by 1000 installers; it's all broken!)(Citation: Carbon Black Shlayer Feb 2019)(Citation: OSX Coldroot RAT) This technique may be combined with Masquerading to trick the user into granting escalated privileges to malicious code.(Citation: Death by 1000 installers; it's all broken!)(Citation: Carbon Black Shlayer Feb 2019) This technique has also been shown to work by modifying legitimate programs present on the machine that make use of this API.(Citation: Death by 1000 installers; it's all broken!)
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| PR.PS-05.02 | Mobile code prevention | Mitigates | T1548.004 | Elevated Execution with Prompt |
Comments
Mobile code procedures address specific actions taken to prevent the development, acquisition, and introduction of unacceptable mobile code within organizational systems, including requiring mobile code to be digitally signed by a trusted source.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CM-06 | Configuration Settings | mitigates | T1548.004 | Elevated Execution with Prompt | |
| SC-18 | Mobile Code | mitigates | T1548.004 | Elevated Execution with Prompt | |
| SI-12 | Information Management and Retention | mitigates | T1548.004 | Elevated Execution with Prompt | |
| SC-34 | Non-modifiable Executable Programs | mitigates | T1548.004 | Elevated Execution with Prompt | |
| SI-16 | Memory Protection | mitigates | T1548.004 | Elevated Execution with Prompt | |
| CM-08 | System Component Inventory | mitigates | T1548.004 | Elevated Execution with Prompt | |
| SI-03 | Malicious Code Protection | mitigates | T1548.004 | Elevated Execution with Prompt | |
| SI-07 | Software, Firmware, and Information Integrity | mitigates | T1548.004 | Elevated Execution with Prompt | |
| CM-02 | Baseline Configuration | mitigates | T1548.004 | Elevated Execution with Prompt | |
| CM-07 | Least Functionality | mitigates | T1548.004 | Elevated Execution with Prompt | |
| SI-04 | System Monitoring | mitigates | T1548.004 | Elevated Execution with Prompt |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| action.hacking.variety.Abuse of functionality | Abuse of functionality. | related-to | T1548.004 | Elevated Execution with Prompt | |
| action.hacking.variety.Exploit misconfig | Exploit a misconfiguration (vs vuln or weakness) | related-to | T1548.004 | Elevated Execution with Prompt |