Pedro Vilaça, lead researcher at security firm SentinelOne, has discovered a zero-day vulnerability that affects all current versions of Mac OS X, as he reports in a recent post.
The researcher describes the vulnerability as a non-memory corruption bug, which allows attackers to execute remote code on any computer and then escalate system privileges and assume root privileges.
This allows attackers to gain root access to almost all recent versions of Mac OS X, and specifically in Mac OS X El Capitan, this bug could allow an attacker to bypass the System Integrity Protection (SIP) mechanism, the recent security feature introduced by Apple in the operating system.
Attackers can bypass SIP and then leverage this mechanism to their advantage, protecting their malware.
SIP is designed by Apple to prevent any users, even those with root privileges, from modifying essential system files. The bug discovered by the researcher can bypass this protection, modifying system files, and allowing the malware to remain active on infected devices.
[su_button url=”https://www.secnews.gr/102456/apple-released-imessage-patch/” target=”blank” style=”glass4″ wide=”yes”]Apple fixes serious encryption flaws in iMessage[/su_button]
Even if users discovered the infection, removing it would be nearly impossible since SIP could work against them, preventing the malware from detecting or modifying the system file.
By default, SIP protects the following folders: /System, /usr, /bin, /sbin, along with the applications that come pre-installed with Mac OSX.
According to Vilaça, the vulnerability is easily exploitable, through simple spear-phishing emails or browser-based attacks that are more than enough to compromise systems.
Apple fixed the issue (CVE-2016-1757) with the release of version 10.11.4, OS X El Capitan, released on March 21.
