macOS and OS X use a common method to look for required dynamic libraries (dylib) to load into a program based on search paths. Adversaries can take advantage of ambiguous paths to plant dylibs to gain privilege escalation or persistence. A common method is to see what dylibs an application uses, then plant a malicious version with the same name higher up in the search path. This typically results in the dylib being in the same folder as the application itself. 1 2 If the program is configured to run at a higher privilege level than the current user, then when the dylib is loaded into the application, the dylib will also run at that elevated level. This can be used by adversaries as a privilege escalation technique.
- Writing Bad Malware for OSX
- Malware Persistence on OS X
使用该技术的组织
参考表中尚无组织使用记录。
断言
尚无指向该技术的公开断言。
记录自动入库·未人工复核；置信度与有效期按引用读取。