Bypassing macOS Security and Privacy Mechanisms: From Gatekeeper to System Integrity Protectio
summary
Shows concrete exploits and working demos: a quarantine propagation bug where the uchg file flag prevents quarantine attributes from being applied after TGZ extraction, letting unsigned apps run without Gatekeeper checks and fixed in Ventura 13.3; an aot poisoning technique that corrupts Rosetta 2 AOT caches to inject shellcode and bypass TCC and XProtect, patched in Ventura 13 and 13.4; and several package postinstall symlink race attacks that overwrite SIP protected files to grant full system privileges, with PoC code published on GitHub.
AI-written summary · about
chapters (9)
- 0:00macOS security overview
- 4:19Gatekeeper bypass vulnerability
- 13:36Sandbox bypass techniques
- 16:24TCC mechanisms and bypass
- 21:15RZ2 code injection exploit
- 27:40TCC bypass demo
- 30:48SIP protection and bypass importance
- 35:51Signed package SIP bypass
- 40:46Summary macOS security bypass
related talks
36mmacOS Vulnerabilities Hiding in Plain Sight
51mAll Your Macs Are Belong To Us ... Again!
40mKnockout Win Against TCC - 20+ NEW Ways to Bypass Your MacOS Privacy Mechanisms
57mExploring Yosemite: Abusing Mac OS X 10.10
29mStealing All macOS Sensitive Info with a Single Vulnerability
54mSubverting Apple Graphics: Practical Approaches to Remotely Gaining Root
43mFrom u0 to Millionaire - Attacking Interprocess Communication...
45mmacOS application isolation and its exploitation