macOS Vulnerabilities Hiding in Plain Sight
summary
Three concrete macOS bugs: a CFPreferences daemon flaw (CVE-2021-1815) lets an unprivileged process create a directory with root ownership via mkdirat, enabling root by dropping scripts into /usr/local/… (worked via periodic scripts or invoking sysdiagnose); a TCC weakness lets a fake app with the same bundle id inherit another app’s camera/mic grants because code-sign is checked on disk not the running process (TCC fake-bundle-id bypass); and a Disk Arbitration race lets a sandboxed app map a dmg to /dev, race a mount over ~/Library/Preferences and get Terminal to run arbitrary commands (disk arbitration race-to-mount).
AI-written summary · about
chapters (8)
- 0:00Start
- 1:37INTRO
- 3:16cfprefsd
- 4:10original vulnerability
- 4:59original exploit
- 7:06exploit method #1
- 9:39exploit method #2
- 34:26conclusion
related talks
42mBypassing macOS Security and Privacy Mechanisms: From Gatekeeper to System Integrity Protectio
40mKnockout Win Against TCC - 20+ NEW Ways to Bypass Your MacOS Privacy Mechanisms
29mStealing All macOS Sensitive Info with a Single Vulnerability
54mSubverting Apple Graphics: Practical Approaches to Remotely Gaining Root
33mA Deep Dive into A Vulnerability Apple Deems Unexploitable
36mThe Price of Compatibility: Defeating macOS Kernel Using Extended File Attributes
51mAll Your Macs Are Belong To Us ... Again!
35mRacing the Dark: A New TOCTTOU Story From Apple's Core