Software Patches Flaw on macOS Could Let Hackers Bypass All Security Levels

guest · Aug 15, 2022

August 15, 2022

An injection flaw connected to how macOS handles software updates on the system could allow attackers to access all files on Mac devices.

The news comes from Mac security specialist Patrick Wardle who, in a Sector7 blog post (and at the Black Hat conference in Las Vegas), demonstrated how threat actors could abuse the flaw to take over the device.
Click to expand...

After deploying the initial attack, Alkemade was then able to escape the macOS sandbox (a feature designed to limit successful hacks to one app), and then bypass the System Integrity Protection (SIP), which effectively enabled the deployment of non-authorized code.

Wardle also explained that while the vulnerability leveraged multiple flaws after he discovered it to Apple, the company addressed most of them in April 2021, and one was patched in October 2021.
Click to expand...

Both updates do not delve into the technical details of the vulnerabilities, simply saying the flaw could allow malicious apps to leak sensitive user information and escalate privileges for an attacker.

“In the current security architecture of macOS, process injection is a powerful technique,” Wardle wrote in his blog post.

“A generic process injection vulnerability can be used to escape the sandbox, elevate privileges to root and to bypass SIP’s filesystem restrictions. We have demonstrated how we used the use of insecure deserialization in the loading of an application’s saved state to inject into any Cocoa process,” the advisory concluded.
Click to expand...

Sector7: Process injection: breaking all macOS security layers with a single vulnerability

In macOS 12.0.1 Monterey, Apple fixed CVE-2021-30873. This was a process injection vulnerability affecting (essentially) all macOS AppKit-based applications. We reported this vulnerability to Apple, along with methods to use this vulnerability to escape the sandbox, elevate privileges to root and bypass the filesystem restrictions of SIP. In this post, we will first describe what process injection is, then the details of this vulnerability and finally how we abused it.
Click to expand...

Rasheed187 · Aug 20, 2022

Another thing that's rather silly is that Apple forces all browsers to be based on the WebKit engine, so switching from Safari to Chrome or some other browser wouldn't even help, if I'm correct. Here's some more interesting info:

https://nakedsecurity.sophos.com/20...le-zero-day-in-browser-and-kernel-update-now/

Log in or Sign up

Software Patches Flaw on macOS Could Let Hackers Bypass All Security Levels

guest Guest

Rasheed187 Registered Member

Log in or Sign up

Software Patches Flaw on macOS Could Let Hackers Bypass All Security Levels

guest Guest

Rasheed187 Registered Member

Useful Searches