- Microsoft reveals an in-depth analysis of a bug it recently found in macOS
- The flaw is potentially dangerous as it allows threat actors to bypass SIP
- SIP is a security feature designed to protect critical system files
Microsoft has released an in-depth technical analysis of CVE-2024-44243, a moderate macOS vulnerability that could allow attackers to deploy malware that cannot be deleted.
macOS devices come with System Integrity Protection (SIP), (aka “rootless”) a security feature designed to protect critical system files and processes from being modified, even by users with root privileges. It was first introduced in macOS El Capitan and is designed to restrict access to system folders and enforce code integrity.
SIP can be temporarily disabled for specific tasks, but doing so requires restarting the system in recovery mode and using Terminal commands.
Affects entire OS security
The flaw allows local attackers with root privilege to mount low-complexity attacks through which they can bypass SIP root restriction, even if they do not have physical access to the measurement endpoint. As a result, they can install rootkits, “undeletable” malware, and bypass Apple’s Transparency, Consent and Control (TCC) security framework.
In its recipe, Microsoft described how devastating bypassing SIP can be: “Bypassing SIP affects the security of the entire operating system and can lead to serious consequences, underscoring the need for comprehensive security solutions that can detect abnormal behavior from specially privileged processes,” it said Redmond.
“The challenge of detecting such threats is compounded by the inherent limitations of kernel-level visibility on macOS, making it difficult for traditional security measures to detect and mitigate these sophisticated attacks.”
The flaw was first discovered in late 2024 by both Microsoft and a separate security researcher, Mickey Jin, who both responsibly disclosed it to Apple, who fixed it on December 11, 2024 through macOS Sequoia 15.2.
Although there is no abuse in nature, users are still advised to apply the patch as soon as possible.
Via Bleeping Computer
