Elevated Execution with Prompt is a macOS privilege escalation technique, tracked by MITRE as T1548.004. It is one of the ways to abuse an elevation control mechanism, and it works because a legitimate API trusts the caller too much.
How attackers use it
The AuthorizationExecuteWithPrivileges API gives developers an easy way to run operations as root, such as installing or updating software. It does not check whether the program requesting root comes from a reputable source or has been modified.
MITRE notes the API is deprecated but still fully functions in the latest releases of macOS. When called, the user sees a prompt for credentials, but no checks on the origin or integrity of the program are made. The caller may also load world writable files that can be edited to run malicious behavior with elevated privileges.
Adversaries can use it to get root to install malicious software and persistence mechanisms. It can be paired with Masquerading so the prompt looks trustworthy, and it has also been shown to work by modifying legitimate programs that already use the API.
How to detect it
MITRE points to /usr/libexec/security_authtrampoline, the helper involved when this API is invoked. Correlate three things: use of the API, the reputation of the calling binary, and the context of the prompt. A credential prompt that appears with no matching user action, from an app that has no reason to install anything, deserves a look.
How to reduce the risk
MITRE lists Execution Prevention. System settings can block applications that were not downloaded through the Apple Store, and refusing unsigned applications reduces risk further. Teach users that a surprise password prompt from an unfamiliar app is a reason to stop and ask.
Quick check
What does the API fail to verify?
It does not validate that the program requesting root comes from a reputable source or has not been tampered with.
Sources
- MITRE ATT&CK, Abuse Elevation Control Mechanism: Elevated Execution with Prompt: https://attack.mitre.org/techniques/T1548/004
