Apple fixes macOS vulnerability that could lead to persistent malware

Apple has patched a vulnerability in macOS that could lead to virtually unremovable malware. Apple knew about the leak because Microsoft researchers discovered it and shared their findings with the macOS maker.

Apple names the Microsoft researchers in the changelog. Those researchers now have too posted their own findings online. They call the exploit Migraine because it uses Migration Assistant, a tool to transfer data from a previous PC to a new Mac. The exploit makes it possible to post files thanks to System Integrity Protection or get SIP protection against deletion. This makes it possible to install rootkits or persistent malware. This is malware that remains on the system even after a restart. To our knowledge, it is the first vulnerability that allows SIP to be bypassed without physical access to a system.

Migration Assistant runs several scripts that allow arbitrary code execution. The Microsoft researchers managed to carry out a remote attack by starting the Migration Assistant with a few parameters, so that a user does not have to be logged out to start it. This enables the use of an AppleScript to start the Migration Assistant and guide it through the steps to load the code. There is no evidence that the exploit has been exploited in the wild. Apple recently fixed the vulnerability in macOS Ventura.