Stealing All macOS Sensitive Info with a Single Vulnerability
summary
A macOS privilege error grants gcore the com.apple.system-task-ports.read entitlement so a one-line PoC dumps any process—even with SIP—by running gcore, parsing vmmap and searching ~10–20 candidates for the 24-byte master key in securityd memory to decrypt the login keychain and extract Chrome Safe Storage; the same dump-and-patch flow bypasses TCC (contacts, files, emails) and can decrypt FairPlay iOS apps on macOS for analysis without a jailbreak (demo on BlueSky succeeds); Apple removes the entitlement in 15.3; detect via EndpointSecurity get_task_read.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:50Mac OS security model
- 9:09Discovering the vulnerability
- 11:37Dumping login keychain
- 18:02Bypassing TCC protection
- 20:52Decrypting iOS apps
- 26:12Finding similar bugs
- 27:19Detecting exploitation
- 28:02Conclusion and takeaways
related talks
36mmacOS Vulnerabilities Hiding in Plain Sight
42mBypassing macOS Security and Privacy Mechanisms: From Gatekeeper to System Integrity Protectio
40mKnockout Win Against TCC - 20+ NEW Ways to Bypass Your MacOS Privacy Mechanisms
38mSide Channel Attacks: Lessons Learned Or Troubles Ahead?
54mSubverting Apple Graphics: Practical Approaches to Remotely Gaining Root
54mmacOS: Tracking High Profile Targeted Attacks, Threat Actors & TTPs
32mA Case Study of MacOS Supply Chain Compromise
50mRo(o)tten Apples: Vulnerability Heaven in the iOS Sandbox