Apple recently addressed a bug in macOS that allows attackers to bypass System Integrity Protection (SIP) and install malicious kernel drivers by loading third-party kernel extensions.
See also: Apple releases important security updates for iOS and macOS
System Integrity Protection (SIP), or "rootless", is a macOS security feature that prevents malware from changing specific folders and files by limiting the powers of the root user account to protected areas.
SIP allows only Apple-signed processes or those with special permissions, such as Apple software updates, to modify macOS-protected components. Disabling SIP typically requires a system restart and booting into macOS Recovery (the built-in recovery system), which requires physical access to a compromised device .
The macOS bug (tracked as CVE-2024-44243), which can only be exploited by local attackers with root privileges in low-sophistication attacks requiring user interaction, was discovered in the Storage Kit daemon, which handles disk state retention.
Successful exploitation could allow attackers to bypass SIP root restrictions without physical access to install rootkits, create persistent, “undeletable” malware, or bypass security checks to access victims’ data.
See also: macOS Malware Banshee Stealer source code leaked
Apple is fixing the bug in security updates for macOS Sequoia 15.2, which was released a month ago, on December 11, 2024.
Microsoft security researchers have discovered several bugs in macOS over the past few years. A SIP bypass called “Shrootless” (CVE-2021-30892), reported in 2021, also allows attackers to perform arbitrary operations on compromised Macs and potentially install rootkits.
More recently, they also found another SIP bypass named "Migraine" (CVE-2023-32369) and a security flaw known as Achilles (CVE-2022-42821), which can be exploited to deploy malware via untrusted applications capable of bypassing Gatekeeper.
Microsoft's principal security researcher, Jonathan Bar Or , also discovered " powerdir " (CVE-2021-30970), another bug in macOS that allows attackers to bypass Transparency, Consent and Control (TCC) technology to access macOS users' protected data
See also: North Korean hackers target macOS systems with Flutter apps
Malicious kernel drivers pose a significant threat to system security because they operate at the highest level of privilege in an operating system. These drivers can be used by attackers to evade detection, disable security measures, or gain unauthorized access to system resources. Once installed, they can manipulate basic system functions, making them difficult to detect and remove. Protecting against such threats requires strong security practices, including rigorous validation of driver signatures and regular updates to operating system security policies. Recognizing the risk of these drivers is critical to maintaining system integrity and safeguarding sensitive information.
Source: bleepingcomputer
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
