1

So I'm using an untrusted computer but on a trusted network (my home). The operating-system + hardware are trusted but the Profiles, certificates & software installed in the system are not trusted.

I can in fact see a bunch of certificates installed on the machine by going into my Profiles settings with names such as "Kernel Extensions" and many other Profiles. And my actual account on the OS (uses my own password) has a bunch of untrusted software installed which I'd like to keep there just so I understand better the layers of security involved.

Now I know this an untrusted machine but I'm trying to learn and understand up until which layers they can get access to. This is purely educational, I'm not trying to use an untrusted computer for my personal use.

Given that I trust the OS and the hardware (being Apple and all) I was wondering what are the exact repercussions of me downloading and installing Chrome (hence also trusting Chrome of course) and logging into my Gmail account (note I have 2FA enabled).

Questions:

  • Can the person/group access my emails. If yes, how?
    • Can they read my Chrome settings in clear? Say my browser history. If yes, how?
    • Can they possibly access the disk files in Chrome's settings folders and use these files to try and access my email? If yes, how?

Please note I know they can probably read and understand a bunch of things via network logs and keylogging since they could've installed any spyware software on the machine, but I'm mainly concerned about accessing my email (in gmail) via chrome specifically. And am mainly curious on how they would do that.

2 Answers 2

1

It is the good old weapon vs armor question. If you can know in advance what parts of the system could have been infected, you can imagine a secure path avoiding them.

For example if only a small number of high level application executables have been altered and not the most basic tools like the shell and the low level command line utilities like cp, you can use a bash terminal to install back a secure Chrome application with a default config.

But if you do not know exactly what can have been changed you can only pray to know the system better than the attackers do. If they have installed something that you do not imagine (a key logger, or any other low level logging module in the kernel). The image is that they only have a tooth pick and you have a leather armor, then you are safe, but even if you have a heavy plate armor but they have an automatic riffle, then you have lost.

Said differently there is nothing bad in building a precise attack scenario, and then imagine how you can still escape from it: you will learn a bunch of security technics both offensive and defensive. But if it is a I have been attacked, and I do not know what can have been compromissed challenge, only a clean system re-install is safe.

6
  • Thanks but can I not use the fact that I trust the OS to provide this assurance for me? After all an OS is by definition a sandboxing system. I can go to System Preferences -> Security & Privacy in macOS to figure out exactly what part of the system apps get access to (from disk access to camera etc). So imagining that the OS wasn't compromised, shouldn't I be able to see which software is tracking my activities through this panel? If not, how would the malicious software be able to bypass this panel? Commented Jul 2, 2021 at 12:01
  • 1
    If you are sure that no part in the OS has been compromised, you can rely on that. But do you realize that when you click System Preferences -> Security & Privacy you are only triggering a user level program which in turn interact with the kernel. What if that program has been altered? BTW the assertion an OS is by definition a sandboxing system is wrong. Each process can only access its own memory, but disk files are shared... Commented Jul 2, 2021 at 12:07
  • Makes sense. Maybe though we can think of this from the malicious perspective: how would they go about to change the "Security & Privacy" program UI to behave like the native one? Could someone actually change the internals of the proprietary macOS system and change its appearance in such a way that the native "Security & Private" program is hidden from the user? They would literally have to change the "System Preferences" native panel. Would you have an idea on how they would go about doing that? Commented Jul 2, 2021 at 12:13
  • @LucaMatteis: The same way bad guys can send mail pretending coming from your bank: they watch how a legitimate mail/application screen looks like, and they forge a new mail/application_screen that just looks like the original one. If they are stupid you will immediately notice typos everywhere, if they do a good job... Commented Jul 2, 2021 at 12:21
  • Makes sense. Apart from this, what can the macOS certificate device profiles allow the malicious users to do? This is the section appearing in the System Preferences -> Profiles. I see several of these installed but am unaware how they work. Will this allow them to circumnavigate the "Security & Privacy" sandbox (assuming it's the native non-exploited one) and gain access to further things? Commented Jul 2, 2021 at 12:27
0

which kind of software installed is important. it can be monitoring softwares to track activities. There are monitoring tools which can track all activities including what your are browsing/Viewing. Mostly they used proxies to track. So this tools can track your registry, disk space, all types of logs(depends on configuration), applications and their settings too. so there are different SIEM and DLP tools available.

accessing gmail(sending email on behalf of you) is not that easy even its non trusted network/zone. as mentioned you have 2fa, so it will help to manage risk.

Just try to get information on which softwares installed, and network configuration (DNS, Proxies/certificates).

1
  • Thanks! In macOS if I go to System Preferences -> Security & Privacy, there's an entire section dedicated to the "sandboxing" of the OS. This section tells you exactly what each and every software is able to access. From "Full Disk Access" to "Screen Recording" etc. Am I safe to assume that a "monitoring tool" would have to show up here in order to track my activities? If not, how did the monitoring tool bypass this? Commented Jul 2, 2021 at 7:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .