Security & Privacy in macOS 10.15 Beta

Advances in macOS Security:

We are on a journey to continuously improve macOS security, with a particular focus on preventing malware and protecting user data. Join us on the next step and learn more about what's new in Gatekeeper—for keeping malware out of macOS—as well as new protections that help keep users' data and activity under their control.

Kyle Howells:

Apple still refuses to put an “Allow” button on the macOS security prompts I can see.

Thomas Tempelmann:

And still no option to tell macOS that you trust an app accessing everything at once, instead of being asked for every detail separately? It’s already a pain with apps like iClip and Timing to be acknowledge them using AppleEvents on every app you touch.

Zack Whittaker (tweet):

But the protections [in macOS 10.14] weren’t very good. Those ‘allow’ boxes can be subverted with a maliciously manufactured click.

[…]

Wardle, who revealed the zero-day flaw at his conference Objective By The Sea in Monaco on Sunday, said the bug stems from an undocumented whitelist of approved macOS apps that are allowed to create synthetic clicks to prevent them from breaking.

Felix Schwarz:

Just when you thought kext development couldn’t get any more frustrating… a “New Feature” arrives.

DriverKit (Hacker News):

The DriverKit framework provides C++ classes for IO services, device matching, memory descriptors, and dispatch queues. It also defines IO-appropriate types for numbers, collections, strings, and other common types. You use these with family-specific driver frameworks like USBDriverKit and HIDDriverKit.

Felix Schwarz:

Wow! macOS #Catalina adds new frameworks to allow drivers to run IN USER SPACE & manage them via “SystemExtensions”!

More on macOS Catalina #DriverKit drivers:

- packaged alongside the app like modern app extensions.
- removed from the system when the host app is
- (possibly) can be dynamically loaded & unloaded them as needed using OSSystemExtensionRequests

In #SOTU, Apple just announced that “in a future #macOS release”, KEXTs targeting driver categories covered by #DriverKit will no longer work and encouraged developers to adopt #DriverKit now.

Jeff Johnson:

A lot of things bothered me yesterday, but I think the one thing that bothered me the most was 10.15 locking down the Documents folder.

In the past, Documents was the place that apps were supposed to use. Now it’s forbidden ground.

The Mac is dying from permission dialogs.

All About Notarization:

Notarization is all about identifying and blocking malicious Mac software prior to distribution, without requiring App Review or the Mac App Store. Introduced last year and already widely adopted by Mac app developers, this is your opportunity to take an in depth tour of Notarization workflows and find out what's new with the Notarization service.

Mark Munz (Rich Trouton):

‘All About Notarization was somewhat disappointing.

They kind of quickly explained Sparkle.framework issue. 🤷‍♂️

But looks like zero workflow improvements to automation & notarization. 😞

Jeff Johnson:

For Mac App Store apps, I suspect that Catalina will be a very easy update. Not many changes as far as I can tell.

For non-sandboxed apps on the other hand... I pray for you.

Steve Troughton-Smith:

Good news: macOS Catalina still respects your System Integrity Protection setting and lets you write to to the hard disk root if SIP is off

Previously:

• macOS 10.15 Beta
• macOS 10.14.5 Whitelists Kernel Extensions
• macOS 10.14.5 Requires New Developers to Notarize
• Mojave Privacy Protection Aftermath
• No NVIDIA Drivers for Mojave
• Kernel Extensions in High Sierra

Update (2019-06-10): Jeff Johnson:

Wait, according to the “Advances in macOS Security” video (9:30 mark), there’s no more first launch Gatekeeper dialog for standalone executables on Catalina?

Howard Oakley:

This changes again as of 1 June 2019 with respect to Catalina, but not (as far as we know) in Mojave. From that date onwards, all newly-signed apps and other executable code which undergo first run checks (because of a quarantine flag) are required to have been notarized. You can still run apps which haven’t been notarized or even remain unsigned in Catalina, though.

Update (2019-06-11): Rosyna Keller:

macOS never had a first launch prompt for anything not going through LaunchServices before. Catalina is the first to add it for quarantined files not going through LaunchServices.

Daniel Jalkut:

OMG tccutil in Catalina actually accepts the bundle ID it has claimed to accept for years:

% tccutil reset AppleEvents com.red-sweater.fastscripts

successfully reset AppleEvents approval status for com.red-sweater.fastscripts

Update (2019-06-18): SentinelOne:

10.15 sees some major developments that will affect both the enterprise and developers of security solutions. In this post, we round up what’s been announced so far and explain how it could affect you.

Update (2019-07-01): Peter Steinberger:

Catalina still offers “Allow apps downloaded from anywhere” if you use the terminal.

sudo spctl --master-disable

(Firefox updater stopped working without)

Update (2019-10-13): Felix Schwarz:

127 days have passed since I requested #DriverKit entitlements from @Apple. #Catalina, meanwhile, has shipped.

Still didn’t hear back. Has anyone?

Update (2019-10-17): Mr. Macintosh:

Check this out, Apple REMOVED the line below.

“Installing third party kernel extensions now requires that you restart your Mac before they’re permitted to load.”

DriverKit Gatekeeper Kernel Extensions Launch Services Mac macOS 10.14 Mojave macOS 10.15 Catalina Malware Notarization Privacy Security System Integrity Protection Transparency Consent and Control (TCC)

22 Comments RSS · Twitter

Leave a Comment

Name

E-mail (will not be published)

Web site

Δ