Name: New macOS attack vector exploits 'security theater,' developer claims | AppleInsider
Brand: appleinsider.com
SKU: appleinsider-com-13
Availability: OnlineOnly

critic

New macOS attack vector exploits 'security theater,' developer claims | AppleInsider

preview

&nbsp;&nbsp;&nbsp;AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content.A developer has discovered an exploit that can bypass the operating system's file privacy and security protections. The exploit, created by developer Jeff Johnson, impacts the "" (TCC) framework that was introduced in macOS Mojave. Johnson also tested the exploit in and the first beta. Essentially, the TCC framework restricts the ability for apps in macOS to access certain protected files or folders. As an example, Johnson that an app may not have access to the ~/Library/Safari folder unless it is explicitly granted. In a blog post disclosing the exploit, Johnson said that there are two fatal flaws to the protections — exceptions are based on a bundle identifier instead of a file path, and the system only "superficially" checks an app's code signature. "Thus, an attacker can make a copy of an app at a different location on disk, modify the resources of the copy, and the copy of the app with modified resources will still have the same file access as the original app, in this case, Safari," Johnson wrote. A proof-of-concept attack created by the developer uses a flaw in Safari to leverage those vulnerabilities. It involves a modified version of Safari which can access protected files and send off private data to a server. The second app is the one that actually downloads and launches the modified Safari — a task that any app downloaded from the web can accomplish. Because of the exploit, Johnson claims that the Mac's privacy protections are "mainly security theater and only harm legitimate Mac developers allowing apps to bypass them through many existing holes." The developer first disclosed the bug to the in December 2019, sparking several months of back-and-forth updates. Although Apple Product Security told Johnson they'd fix the issue in spring 2020, he said that it's still present in the macOS 11 Big Sur beta. Importantly, the exploit only really impacts the privacy protections built into macOS Mojave and later. In other words, it takes macOS security back to High Sierra and earlier. Because of that, Johnson writes that the level of concern over the vulnerability really depends on "how you feel in general about macOS privacy protections." The exploit can be leveraged by non-sandboxed malicious apps on a Mac, so the best mitigation strategy would be to exercise caution when downloading any app not from the Mac .I still can't understand why Apple isn't following established exploit handling protocol. Is it arrogance? Why have the bounty program at all? This is not the first disclosure that gets handled weirdly and incredibly slow.Please enable JavaScript to comment&nbsp;An app called Diffusion Bee lets users run the Stable Diffusion machine learning model locally on their Apple Silicon Mac to create AI-generated art. Here's how to get started.Apple has released a complete set of updates spanning iOS, iPadOS, and macOS to ensure users can stay up to date without upgrading to iOS 16 or buying newer supported products.Does the iPhone 14 event really excite you? Do you like teaching people how to use that iPhone or iPad? We may have the perfect opportunity for you.Apple released the Apple Watch Series 8 alongside an updated Apple Watch SE on September 7. Here's how they compare with one another.Apple made considerable upgrades to the iPhone 14 Pro while making fewer than usual to the iPhone 14. Here's how the two similar-sized flagship iPhone models differ.Apple's iPhone 14 Pro and iPhone 14 Pro Max have arrived. Here's how they stack up versus the iPhone 13 Pro and Pro Max.Apple's iPhone 14 is aimed at about the same market that the iPhone SE targets. Here's how it compares to the third-generation iPhone SE.Apple announced the second generation of AirPods Pro at its "Far Out" event on September 7. Here's how it compares to the first generation.&nbsp;Apple has begun contacting developers to encourage them to purchase ad space in the App Store, because of an imminent expansion of slots.Mophie's newest charging lineup aims to keep your new Apple gear topped up all day long.B&amp;H is throwing an epic MacBook Pro sale, with markdowns of up to $400 off and no interest financing for 24 months on select models when you shop with Payboo. Hurry, though, as this September savings event ends soon.Adobe has released its 2022 Emoji Report, showing that the popularity and acceptance of emoji for communication is only growing.New in iOS 16 is the ability to add widgets to your Lock Screen. We've curated the top third-party apps that have already added support for these highly-visible widgets that you can download now.LG's professional-grade UltraFine OLED Pro displays are heavily discounted this week, offering content professionals true 10-bit color and 99% Adobe RGB color gamut coverage in your choice of 27-inch or 32-inch sizes.Apple released the Apple Watch Series 8 alongside an updated Apple Watch SE on September 7. Here's how they compare with one another.High demand for the iPhone 14 Pro and iPhone 14 Pro Max led to Apple server crashes in China as consumers placed over two million preorders in 24 hours.An app called Diffusion Bee lets users run the Stable Diffusion machine learning model locally on their Apple Silicon Mac to create AI-generated art. Here's how to get started.Apple has released a complete set of updates spanning iOS, iPadOS, and macOS to ensure users can stay up to date without upgrading to iOS 16 or buying newer supported products.Does the iPhone 14 event really excite you? Do you like teaching people how to use that iPhone or iPad? We may have the perfect opportunity for you.New in iOS 16 is the ability to add widgets to your Lock Screen. We've curated the top third-party apps that have already added support for these highly-visible widgets that you can download now.Apple's iOS 16 makes the iPhone more customizable than ever. This is the ultimate guide on how to make the iPhone a more personal device.It's been a rocky road to the iOS 16 launch. Here are the high-profile features that didn't debut in the initial release of Apple's operating system.Apple's annual update to its operating system brings new features and much-needed changes. Here are the stand-out features in iOS 16.Apple's "Far Out" event is on September 7. Beyond the new iPhone 14, here's what to expect from September's Apple event — and beyond.Less an overhaul and more refining what's already in place, iOS 16 is all about personalization on top of a retained solid foundation.With the SwitchEasy four-in-one MagPower multi-charger, you can power up all your gear with a single device — including your Apple Watch with an Apple-certified puck.The Benks Grand Pro Headphone Stand for AirPods Max is a welcome upgrade over the original. However, it introduces complexity where there was none before — while also ignoring an obvious problem.Keep tabs on the air quality of your home — including potentially deadly radon levels — with the Airthings View Plus.Apple didn't make a Magic Keyboard for iPad mini 6, and Lululook's Magnetic Keyboard perhaps acts as a testament to why.{{ summary }}{{{ reviewStars.html }}}

&nbsp;&nbsp;&nbsp;AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content.A developer has discovered an exploit that can bypass the operating system's file privacy and security protections. The exploit, created by developer Jeff Johnson, impacts the "" (TCC) framework that was introduced in macOS Mojave. Johnson also tested the exploit in and the first beta. Essentially, the TCC framework restricts the ability for apps in macOS to access certain...

New macOS attack vector exploits 'security theater,' developer claims | AppleInsider

No article scores yet.

CRITIC REVIEWS

PUBLIC REVIEWS