Apple is fixing a security flaw in macOS that Microsoft researchers found could be used to install a malicious kernel driver, known as a "rootkit.".
See also: MacOS Monterey is now available on all Macs!
The flaw was in macOS System Integrity Protection (SIP). The bug allowed a potential attacker to install a hardware interface that would allow them to “replace system files or install undetectable malware.”.
The discovery reflects Microsoft's increased focus on enterprise customers who use a mix of Windows and macOS in hybrid work settings, evidenced by products like its cross-platform security product, Microsoft Defender for Endpoint. Microsoft introduced Defender ATP for Mac in 2019, long before the pandemic pushed everyone to the hardware they used at home.
SIP, also known as “rootless,” locks down the system from root using Apple’s sandbox to protect macOS. It contains many memory-based variables that should not be modifiable in non-recovery mode. However, SIP can be disabled after booting into recovery mode, allowing an attacker to bypass SIP protections.
See also: New zero-day flaw in macOS allows remote attacks
The flaw Microsoft found in Apple's SIP restrictions is related to system updates that require unrestricted access to SIP-protected directories. Apple "introduced a specific set of permissions that bypass SIP checks by design," writes Jonathan Bar Or, of the Microsoft 365 Defender Research team.
Apple fixed the flaw, tracked as CVE-2021-30892, in macOS Monterey 12.0.1, as well as updates for Catalina and Big Sur.
SIP vulnerabilities are not new, but Microsoft decided that the flaw was serious enough to warrant the name “shrootless.”.
See also: Microsoft Teams launches native notifications in macOS app
Apple also fixed other serious bugs in its latest update for macOS Monterey and earlier versions.
Taking a step back, Microsoft's post touches on a decades-old issue about whether Macs need antivirus and the two companies' respective approaches to the question. Macs, in Apple, don't need antivirus, while Windows PCs do.
Information source: zdnet.com
