macOS Mojave Privacy Bypass Flaw Allows Access to Protected Files

Researcher Patrick Wardle,  today shared some details on a new vulnerability that he’s found in the newly released macOS Mojave update.

In a minute-long clip, Patrick Wardle shows that the security in the dark-themed macOS can be bypassed to reach sensitive user data, such as the information in the address book.

mojave-privacy-bypass-header

According to Wardle, the vulnerability is a result of the way that Apple implemented new macOS privacy protections in the Mojave update.

“I found a trivial, albeit 100% reliable flaw in their implementation,” he told us, adding that it allows a malicious or untrusted app to bypass the new security mechanism and access the sensitive details without authorization.

The bypass does not work with all of the new privacy protection features in macOS Mojave, and hardware-based components, such as the webcam, are not affected. Full details on the vulnerability are not available yet, as Wardle plans to share technical details in November.

In the macOS Mojave update, Apple made a change that requires explicit user consent for apps to access location data, camera, contacts, calendars, reminders, messages history, Safari data, mail databases, and other sensitive data, which should prevent the vulnerability that Wardle demonstrates.

Advertisements