Apple may constantly advertise that the security of its users' privacy is its main concern, but that doesn't mean it doesn't make mistakes. And its latest was discovered by a security researcher in the company's digital assistant , Siri.
Apple technology expert Bob Gendler was examining the macOS operating system to understand more about how Apple trains and personalizes Siri for each user. During his research, he found that the operating system was storing parts emails in plain text, even when they were supposed to be encrypted.
As Gendler mentioned in his post, Apple uses a system process called suggestd, a program that runs continuously, gathering content from various apps. These include Spotlight, Mail, and Messages. By collecting this information, it better understands what each user in order to present them with topics that interest them.
When it collects this information, it stores it in the snippets.db inside the macOS Suggestions. suggestd stores in plain text, even emails that are encrypted with Secure/Multipurpose Mail Extension (S/MIME), a technology that uses public and private keys to protect email messages.
Although an attacker would need full disk access to the system files to see this information, as macOS protects them with System Integrity Protection, there are cases where users need to disable the feature. According to Gendler, any program with full disk access on macOS could potentially collect the data, such as Apple's Finder (the equivalent of Windows File Explorer).
What can you do?
Simply disabling Siri won't help, as it's still running in the background. Instead, you can manually enter a command into your terminal window (you don't need root access to do this):
defaults write com.apple.suggestions SiriCanLearnFromAppBlacklist -array com.apple.mail
If you want to immediately stop Siri from accessing apps , go to System Preferences , then Siri. Click About Siri & Privacy , then remove all of your apps in order.
Gendler also provides a longer script, which you can run to disable Siri from tracking Apple Mail.
It should be mentioned that it is not that easy for an attacker to gain access to the system disk, however it is better to be covered in any case.
Apple said it is aware of the problem and plans to address it in a future software update.
