문서화되지 않은 macOS 인터페이스 식별을 통한 퍼블릭 프레임워크-XPC 서비스 의존성 그래프 생성 및 공격 표면 분석

초록

macOS consists of multi-layered components including public and private frameworks and XPC services. Private frameworks are distributed without official documentation or headers, leaving a substantial portion of the interfaces exposed in the actual system outside the scope of the SDK (Software Development Kit). Such undocumented interfaces represent realistic attack targets that adversaries can exploit. However, existing attack surface analysis research has focused on single-layer interfaces such as system calls and IOKit, failing to sufficiently identify hidden attack surfaces. To address this, the present study proposes a dependency graph construction approach that integrates XPC service and endpoint identification, static and dynamic framework dependency analysis, and ObjC metadata analysis to trace paths from public frameworks through private frameworks to XPC services, and quantitatively validates the methodology against a dataset of 2,918 binaries.

키워드