- Sep 21, 2021
On the very last day of 2017, a macOS security flaw that is claimed to be apparently existing for last 15 years was discovered by a security researcher. From his own Twitter account, Siguza, the researcher, posted, “Woah. One tiny, ugly bug. Fifteen years. Full system compromise.” Though Siguza is yet to officially warn Apple about it, he claims that it is exploitable only if there is a local access to the Mac. He found it in the “IOHIDFamily” component of the software. According to Siguza, full system privileges can be gained using the bug. He has published a detailed description of the flaw in his GitHub profile.
If his claims are true, it can affect all existing Mac operating systems(macOS), though the flaw cannot be remotely exploited. Siguza also clarified on Twitter that he does not possess any sort of ill intent in disclosing the vulnerability. He explained on Twitter, “If I had actually wanted to hurt anyone, I would’ve found some remotely triggerable vuln, written some ransomware worm and not done a write-up on it. Not claiming to be a white-hat or anything, but just sayin…”
People mad at me for dropping a 0day and making them vulnerable: what's your threat model?
If it's script kiddies, you're safe because it's just a LPE and nothing remote.
If it's people who can get remote code exec, what makes you think they don't have kernel r/w as well anyway?
— Siguza (@s1guza) January 1, 2018
“I’m not trying to shame or blame anyone – but if you have to blame someone, fine, put it on me. I can live with that.”
The flaw is very much exploitable by hackers and can be used to take over a Mac. The bug gets triggered by itself as soon as the system logs outs. Siguza gave an example, where a Mac, containing the malware is seen being exploited by waiting till it is rebooted or shut down. Apple is yet to make any official public announcement on the issue.