{"id":37820,"date":"2022-12-05T16:01:30","date_gmt":"2022-12-05T21:01:30","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=37820"},"modified":"2022-12-26T15:31:03","modified_gmt":"2022-12-26T20:31:03","slug":"powerdir-macos-tcc-vulnerability","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2022\/12\/05\/powerdir-macos-tcc-vulnerability\/","title":{"rendered":"Powerdir macOS TCC Vulnerability"},"content":{"rendered":"<p><a href=\"https:\/\/www.macrumors.com\/2022\/01\/10\/microsoft-powerdir-macos-vulnerability\/\">Juli Clover<\/a> (in January):<\/p>\n<blockquote cite=\"https:\/\/www.macrumors.com\/2022\/01\/10\/microsoft-powerdir-macos-vulnerability\/\"><p>Microsoft&rsquo;s 365 Defender Research Team this morning published details on a new &ldquo;Powerdir&rdquo; macOS vulnerability that let an attacker bypass the Transparency, Consent, and Control technology to gain unauthorized access to protected data.<\/p><p>Apple already addressed the CVE-2021-30970 vulnerability in the macOS Monterey 12.1 update[&#8230;]<\/p><\/blockquote>\n\n<p><a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/01\/10\/new-macos-vulnerability-powerdir-could-lead-to-unauthorized-user-data-access\/\">Jonathan Bar Or<\/a>:<\/p>\n<blockquote cite=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/01\/10\/new-macos-vulnerability-powerdir-could-lead-to-unauthorized-user-data-access\/\">\n<p>We discovered that it is possible to programmatically change a target user&rsquo;s home directory and plant a fake TCC database, which stores the consent history of app requests. If exploited on unpatched systems, this vulnerability could allow a malicious actor to potentially orchestrate an attack based on the user&rsquo;s protected personal data.<\/p>\n<p>[&#8230;]<\/p>\n<p>First, Apple protected the system-wide TCC.db via System Integrity Protection (SIP), a macOS feature that prevents unauthorized code execution. Secondly, Apple enforced a TCC policy that only apps with full disk access can access the TCC.db files.<\/p>\n<p>[&#8230;]<\/p>\n<p>While the solution indeed prevents an attack by environment variable poisoning, it does not protect against the core issue. Thus, we set out to investigate: can an app programmatically change the user&rsquo;s home directory and plant a fake TCC.db file?<\/p>\n<\/blockquote>\n\n<p>Previously:<\/p>\n<ul>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2021\/12\/13\/macos-12-1\/\">macOS 12.1<\/a><\/li>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2020\/12\/07\/tcc-doesnt-prevent-protected-folders-from-being-listed\/\">Sandbox Doesn&rsquo;t Protect Files From stat()<\/a><\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"<p>Juli Clover (in January): Microsoft&rsquo;s 365 Defender Research Team this morning published details on a new &ldquo;Powerdir&rdquo; macOS vulnerability that let an attacker bypass the Transparency, Consent, and Control technology to gain unauthorized access to protected data.Apple already addressed the CVE-2021-30970 vulnerability in the macOS Monterey 12.1 update[&#8230;] Jonathan Bar Or: We discovered that it [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"apple_news_api_created_at":"2022-12-05T21:01:33Z","apple_news_api_id":"9c96058a-5f38-4af7-a5de-721784f4f42a","apple_news_api_modified_at":"2022-12-26T20:31:06Z","apple_news_api_revision":"AAAAAAAAAAAAAAAAAAAAAA==","apple_news_api_share_url":"https:\/\/apple.news\/AnJYFil84Svel3nIXhPT0Kg","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":"\"\"","apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"footnotes":""},"categories":[2],"tags":[131,30,1891,355,48,1960],"class_list":["post-37820","post","type-post","status-publish","format-standard","hentry","category-technology","tag-bug","tag-mac","tag-macos-11-0","tag-privacy","tag-security","tag-transparency-consent-and-control-tcc"],"apple_news_notices":[],"_links":{"self":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/37820","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/comments?post=37820"}],"version-history":[{"count":2,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/37820\/revisions"}],"predecessor-version":[{"id":37985,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/37820\/revisions\/37985"}],"wp:attachment":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/media?parent=37820"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/categories?post=37820"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/tags?post=37820"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}