{"uuid": "09587a84-83ba-4fb3-ada3-971cf408b1c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-32369", "type": "seen", "source": "https://t.me/hacking_Attack/104144", "content": "Black Hat Ethical Hacking\nApple Addresses Critical macOS Vulnerability Allowing Undeletable Malware\n\nApple Addresses Critical macOS Vulnerability Allowing Undeletable MalwarePost Views: 2 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Apple Takes Swift Action to Address Critical macOS Vulnerability Exploiting System Integrity Protection (SIP)In a recent development, Apple has promptly responded to a significant vulnerability discovered by Microsoft security researchers. This flaw, codenamed \u201cMigraine\u201d and tracked as CVE-2023-32369, enables attackers with root privileges to bypass System Integrity Protection (SIP) on macOS. By circumventing Transparency, Consent, and Control (TCC) security checks, attackers could install \u201cundeletable\u201d malware and gain unauthorized access to victims\u2019 private data.\n\nApple has released security updates for macOS Ventura 13.4, macOS Monterey 12.6.6, and macOS Big Sur 11.7.7, effectively patching the vulnerability. These updates were rolled out on May 18, just two weeks ago, demonstrating Apple\u2019s commitment to addressing security concerns promptly.\n\nSystem Integrity Protection, commonly known as SIP or \u201crootless,\u201d plays a critical role in macOS security. It prevents potentially malicious software from altering essential system files and directories. SIP achieves this by imposing restrictions on the root user account, limiting its capabilities within protected areas of the operating system. The primary objective of SIP is to ensure that only Apple-signed processes or those with specific entitlements can modify macOS-protected components.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nNotably, disabling SIP is not a straightforward task, as it requires a system restart and booting from macOS Recovery\u2014an option only available when physical access to the compromised device is already obtained.\n\nHowever, Microsoft\u2019s researchers uncovered an avenue for attackers with root permissions to bypass SIP enforcement. They exploited the macOS Migration Assistant utility, leveraging the systemmigrationd daemon\u2019s SIP-bypassing capabilities granted by the com.apple.rootless.install.heritable entitlement. This allowed attackers to automate the migration process using AppleScript, add a malicious payload to SIP\u2019s exclusions list, and execute it without the need for a system restart or macOS Recovery boot. https://wus-streaming-video-rt-microsoft-com.akamaized.net/73e02d08-6769-4514-956b-9490c5fcc132/c39c1947-226e-4f0c-9633-75125a0d_6750.mp4\n\nThe Microsoft Threat Intelligence team showcased that by focusing on system processes signed by Apple and possessing the com.apple.rootless.install.heritable entitlement, they could tamper with specific child processes. This manipulation enabled arbitrary code execution, bypassing SIP checks and creating a security context that evades detection.\n\nBypassing SIP introduces significant risks, particularly when exploited by malware creators. It empowers malicious code to have far-reaching consequences, including the creation of SIP-protected malware that remains resistant to standard deletion methods. Furthermore, it expands the attack surface, allowing attackers to tamper with system integrity through arbitrary kernel code execution. In some cases, attackers could even install rootkits to conceal malicious processes and files from security software.\nTrending: Exploit XSS Injections in a one-line powerful Technique Trending: Recon Tool: Sniffer\nBy bypassing SIP protection, threat actors can completely evade Transparency, Consent, and Control (TCC) policies. This grants them unrestricted access to the v[...]", "creation_timestamp": "2026-09-02T01:01:18.141857Z"}