Vulnerability Disclosure: Vulnerability in macOS Mojave Allows Access to Web Browsing Data

On February 8th, an application developer identified a vulnerability in macOS Mojave that could allow applications to gain unauthorized access to a user’s web browsing history, which could provide insight into sensitive aspects of the user’s browsing trends, such as banking, email, or business. Although this vulnerability has been reported to Apple, as of February 15th it has not been patched and up to the most current version of Mojave is affected by this vulnerability; earlier versions of macOS could also be affected by this vulnerability.

Recommendations

There is no patch yet available for this vulnerability. Users of macOS should:

• Patch their machines as soon as a fix becomes available for Mojave. Users of earlier macOS, such as High Sierra, could also be affected by this vulnerability and should also upgrade their systems accordingly.
• Configure their ZeroFOX platform to monitor for and alert on macOS updates and other software information relevant to your enterprise.

Details

The Mac and iOS application developer Jeff Johnson discovered this vulnerability, which could allow a hacker to bypass protections for the ~/Library/Safari folder in macOS Mojave, a folder which contains a user’s entire web browsing history. Normally, only certain applications have access to this folder, such as Finder. Johnson identified a way to bypass the protection using “hardened runtime” enabled, with no special permissions required by the user. Using this vulnerability, Johnson states a malicious app, once installed, could access the Safari web browsing history without requiring any permissions.

Although Johnson proved this vulnerability affects Mojave, he did so to prove that despite new privacy protections for ~/Library/Safari in Mojave, these protections can be bypassed. These protections do not exist at all in macOS High Sierra and earlier operating systems, and so though it has not been proven, this vulnerability theoretically affects all earlier version of macOS as well.