Every time you turn off your Mac, a pop-up appears: “Are you sure you want to shut down your computer?” There’s another option located under Prompt that most of us probably overlook: the option to reopen the apps and windows you just opened when your machine turns back on. Researchers have now found a way to exploit a vulnerability in this “Saved State” feature — and it could be used to break key layers of Apple’s security protections.
The vulnerability, which makes macOS vulnerable to a process injection attack to break security, could allow an attacker to read every file on a Mac or take control of a webcam, said Thijs, a security researcher at Netherlands-based cybersecurity firm Computest. Says Alchemed, who found the flaw. “It’s basically a vulnerability that can be implemented in three different places,” he says.
After deploying an initial attack against the saved state feature, Alchemed was able to move on from other parts of the Apple ecosystem: first to avoid the macOS sandbox, which is designed to limit successful hacks to a single app. There is, and then there is the exception of System Integrity Protection (SIP), a major defense designed to prevent authorized code from accessing sensitive files on a Mac.
Alchemed—which is presenting the work at the Black Hat conference in Las Vegas this week—first found the vulnerability in December 2020 and reported the issue to Apple through its bug bounty plan. He says he was rewarded “very well” for the research, though he declined to elaborate on how much. Since then Apple has released two updates to fix this flaw, first in April 2021 and second in October 2021.
Asked about the flaw, Apple said it had no comment ahead of Alchemed’s presentation. The company’s two public updates about the vulnerability are light in detail, but they say the problem could allow malicious apps to leak sensitive user information and elevate privileges for an attacker through a system.
Apple’s changes can also be seen in Xcode, the company’s development workspace for app creators, says a blog post describing Alchemed’s attack. The researcher says that while Apple fixed the issue for Macs running the Monterey operating system released in October 2021, previous versions of macOS are still vulnerable to the attack.
There are several steps to successfully launch an attack, but basically they come back to the initial process injection vulnerability. Process injection attacks allow hackers to inject code into a device and run the code in a way that is different from what was originally intended.
Attacks are not uncommon. “It is often possible to find process injection vulnerabilities in a specific application,” Alchemed says. “But such a universally applicable finding is a very rare finding,” he says.