Apple's Envy: Root once, bypass TCC

The talk starts from a common position: an attacker has root on a Mac but still cannot reach protected data. macOS layers mandatory controls on top of root, including System Integrity Protection and the Transparency, Consent and Control (TCC) system, which stores permissions in SQLite databases. The speaker reviews older shortcuts, such as enabling remote login over SSH to inherit Full Disk Access, and explains why Apple closed them in later releases.

The core technique avoids the user interface and consent prompts. A new admin user is created from the command line with the directory service tool, and remote management is enabled through the ARD kickstart command. On Big Sur, default deny entries in the system TCC database block the screen sharing agent from capturing the screen or posting keyboard events, so the speaker removes those entries. A local script then drives the desktop over a loopback VNC session, skips the setup assistant, and grants Terminal Full Disk Access through the privacy panel.

The talk closes by showing that GitHub Actions offers free macOS virtual machines for public repositories. A workflow can run the same steps and open a reverse tunnel for interactive access, giving researchers a test environment without owning a Mac. The practical takeaway is that a single root foothold may be enough to bypass TCC on the releases tested, and the speaker frames the work as use of existing behaviour rather than a new vulnerability.