macOS ‘Migraine’ Exploit Capable of Bypassing System Integrity Protection Detected by Microsoft

Microsoft just lately detected a safety exploit that might enable attackers to bypass a core safety function on computer systems working on macOS. Dubbed “Migraine”, the vulnerability can be utilized to sidestep Apple’s System Integrity Safety (SIP) on macOS — a function that protects components of the working system associated to system integrity by limiting entry to sure recordsdata — and set up malware on a sufferer’s pc. Microsoft warned Apple in regards to the safety flaw and the Cupertino firm has patched the flaw with its newest safety replace.

In response to particulars shared by Microsoft in a blog post, the “Migraine” safety exploit depends on Migration Assistant, a software supplied by Apple to permit customers to switch recordsdata from one Mac to a different or from a Home windows PC to a Mac. The Migration Assistant app from Apple has unrestricted root entry that permits it to carry out its information switch perform, and safety researchers at Microsoft leveraged the particular ‘entitlement’ given to the software, for the exploit.

After modifying the Migration Assistant to run with out logging off a person, Microsoft was in a position to run the software in debug mode to bypass a signature examine. The corporate used a 1GB Time Machine backup with malicious software program, utilizing a script to trigger Migration Assistant to import the backup and infect the host system. All the course of bypassed the System Integrity Safety function that was first launched on macOS in 2015.

Microsoft’s modified Migration Assistant can perform with out signing out
Photograph Credit score: Microsoft

It’s value noting that the Migration Assistant is often out there throughout person setup, which implies that an attacker would wish to have native entry to a machine. Microsoft says that the arbitrary system bypasses like Migraine may create recordsdata which can be protected by SIP, the identical mechanism that it bypasses, making deletion very troublesome. Attackers also can run arbitrary kernel code and tamper with the system to allow rootkits. Microsoft provides that these exploits may also be used to achieve entry to non-public information in addition to pc equipment and units.

Customers who’ve up to date their computer systems to macOS 13.4 after it was rolled out on Could 18 must be secure from the exploit, which has been patched by Apple. Microsoft disclosed the safety flaw to Apple, permitting the agency to roll out a repair for the difficulty. In the meantime, the corporate has thanked Microsoft’s Jonathan Bar Or, Anurag Bohra, and Michael Pearse for figuring out the exploit.