Vulnerability in iOS and macOS Allowed Bypassing TCC Privacy Protections

Apple recently patched a security flaw in iOS and macOS that could bypass the Transparency, Consent, and Control (TCC) mechanism. TCC is designed to safeguard user privacy by controlling app access to sensitive data like location, contacts, microphone, and camera. If exploited, the flaw would allow attackers unauthorized access to this data without user awareness.

---

What is TCC?

Apple’s Transparency, Consent, and Control system manages how apps interact with private data. It operates under three key principles:

• Transparency: Users see which apps request access to sensitive information.
• Consent: Apps must ask for permission before accessing private data.
• Control: Users can manage app permissions in system settings.

TCC helps ensure users remain in charge of their privacy.

---

CVE-2024-44131: Key Details

The vulnerability, tracked as CVE-2024-44131 (CVSS score: 5.3), affects iOS 18, iPadOS 18, and macOS Sequoia 15. The issue resides in the FileProvider component and was discovered by Jamf Threat Labs.

What Happened?

The flaw exploited symbolic links (symlinks) to bypass TCC protections. A malicious app could:

1. Detect when a user copied or moved files in the Files app.
2. Replace a legitimate file with a symlink mid-process.
3. Redirect the file to an attacker-controlled location.

This exploit could give access to:

• Files
• iCloud backups
• Health data
• Microphone or camera streams

All without alerting the user.

---

How Attackers Could Benefit

An attacker could manipulate files within the path /var/mobile/Library/Mobile Documents/, copying or deleting iCloud-stored data for first- and third-party apps. This access could compromise personal files or sensitive backups.

The flaw completely undermines TCC, as it generates no system prompts. The level of data exposure depends on the permissions granted to the process executing the attack.

Jamf researchers noted:

“The severity of these vulnerabilities depends on the privileges of the targeted process. Not all data can be accessed, but the race condition exposes gaps in access controls.”

---

Apple’s Response and User Advice

Apple quickly addressed CVE-2024-44131 by improving symlink validation in the latest system updates. To stay secure:

• Update to iOS 18, iPadOS 18, or macOS Sequoia 15. This is the fastest way to protect against the flaw.
• Organizations should implement tools to monitor app behavior and detect unauthorized data access attempts.

While Apple’s patch fixes the immediate issue, proactive endpoint protection can further safeguard devices by spotting unusual activity or blocking malicious file operations.