NR Labs recently published research showing how attackers can use kcc, a utility built into macOS, to steal a user’s Kerberos Ticket Granting Ticket (TGT) and use it to impersonate that user on a Windows network.
A TGT is a cryptographic authentication token issued by the Key Distribution Center (KDC) that proves a user’s identity and allows them to request access to network services without re-entering their password.. Once the KDC issues a TGT after initial login, the user’s computer uses it to request downstream service tickets without sending the user’s password across the network again.
The team found the technique during a client engagement in a Mac-heavy environment. An undocumented kcc function copies a user’s TGT out of the macOS credential cache. From there, the team converted it with the open-source tool Bifrost and used it with Rubeus on an attacker-controlled Windows machine to authenticate as the victim. This happened easily without an exploit kit or a cracked password.
NR Labs reported this to Apple on September 14. Apple replied on September 21 that the behavior is intended and doesn’t cross a security boundary. Since no patch is coming, the risk now sits with defenders. You can find info on how to deal with the issue here.
I hope you’ll help support Apple World Today by becoming a patron. Almost all our income is from Patreon support and sponsored posts. Patreon pricing ranges from $2 to $10 a month. Thanks in advance for your support.
