Vocabulary:

System Integrity Protection (SIP)	A macOS security feature that protects critical system files. Example: SIP prevents unauthorized changes to system files on macOS.
Root User	A superuser with full permissions to access and modify any part of a system
Kernel Extensions	Code that runs in the macOS kernel, often to provide additional functionality.
Daemon	A background process that performs tasks for the operating system.
Rootkit	Malicious software designed to hide its presence and gain deep control of a system.

Article:

Microsoft has reported a now-fixed security issue in Apple’s macOS that could let attackers bypass System Integrity Protection (SIP) if they had root access. This flaw, called CVE-2024-44243, was fixed in macOS Sequoia 15.2. Apple called it a “configuration issue” that allowed malicious apps to modify protected parts of the system.

SIP, also known as “rootless,” is designed to stop harmful software from altering critical parts of macOS. It restricts even the root user from modifying certain files unless the changes are made by trusted Apple processes.

The issue exploited a component called the Storage Kit daemon (storagekitd), which had permissions to bypass SIP protections. Attackers could use it to install harmful files and override system functions. Microsoft warned that bypassing SIP could allow attackers to install rootkits, create long-lasting malware, and expand their ability to carry out further attacks.

Microsoft highlighted another macOS flaw earlier this year involving the Transparency, Consent, and Control (TCC) framework. These flaws reduce the system’s security and make it easier for attackers to hide their activities.

Questions:

What was the main security issue described in this article?

What is the purpose of SIP on macOS?

How did attackers exploit the Storage Kit daemon to bypass SIP?

What are the risks if SIP is bypassed?

What other macOS security flaw did Microsoft recently disclose?

Discussion:

Do you think macOS is more secure than other operating systems? Why or why not?

How can organizations ensure their devices are protected against vulnerabilities like this?

What trade-offs might occur when increasing security features on an operating system?

How important is collaboration between companies like Microsoft and Apple in addressing security flaws?

If you were in charge of macOS security, what additional steps would you take to protect users?

Source: This exercise is based off an article from Hacker News