Jamf Threat Labs has identified a critical flaw in Apple’s Transparency, Consent, and Control (TCC) framework, labeled CVE-2024-44131. This vulnerability allows malicious applications to bypass user consent protocols and access sensitive data without user awareness. The issue impacts both macOS and iOS platforms but has been resolved in macOS 15 and iOS 18 updates.
The TCC Framework and Its Role
The TCC framework is designed to protect sensitive user data by requiring app permissions. However, the CVE-2024-44131 vulnerability undermines this security mechanism. According to Jamf, “This TCC bypass allows unauthorized access to files, Health data, the microphone or camera, and more without alerting users. This compromises user trust and puts personal data at risk.”
Exploitation Techniques
Attackers exploit this flaw by using symlink techniques and elevated system process privileges, such as those of fileproviderd and Files.app. These methods enable discreet copying of user data into attacker-controlled directories. Jamf noted, “This exploitation can occur in the blink of an eye, entirely undetected by the end user.”
Malicious apps can intercept file operations within the Files.app, redirecting sensitive data without triggering any TCC permission prompts.
Risks Associated with Synchronized Data
The vulnerability highlights the dangers of synchronized data across devices. Jamf explained, “Services like iCloud, which enable data syncing across multiple devices, give attackers multiple entry points to exploit and access valuable intellectual property and data.”
Data stored in iCloud, such as backups from popular apps like WhatsApp, Pages, and GarageBand, is particularly vulnerable due to weak protections. A proof of concept by Jamf demonstrated how attackers could exfiltrate WhatsApp backups stored in iCloud.
Implications of the Vulnerability
- Personal Data Exposure: Sensitive information such as photos, Health data, and contacts may be compromised.
- Corporate Security Risks: The reliance on mobile devices for business operations makes them vulnerable to exploitation.
- Stealth Attacks: The vulnerability allows undetected exploitation, making mitigation challenging.
Apple’s Response
Apple has resolved the CVE-2024-44131 vulnerability in iOS 18 and macOS 15, urging users to update their devices immediately. Organizations are advised to implement proactive security measures to monitor and block suspicious app behaviors.
Jamf emphasized, “While Apple’s OS updates address specific vulnerabilities, proactive endpoint protection is crucial for detecting and blocking unexpected behaviors or abnormal requests.”