Bypassing the Signature Verification and Pwning the Kernel

The talk examines how Apple delivers macOS over-the-air updates and where that process can be abused. It walks through the stages of an update: fetching the privileged update service, downloading and unpacking the package into a temporary location, and handing the package to a service that verifies and applies it. The weak points include a time-of-check, time-of-use window in that temporary directory, where swapping the manifest file for a symbolic link lets an attacker forge checksums for every other file in the package. A second flaw came from a move operation that carried over writable file flags, so unprotected package contents ended up in protected system locations.

Using these primitives, the speaker demonstrates a SIP bypass that removes protected paths through the package's removal list. He then edits a kernel patch file in the undocumented bsdiff format to run code in the kernel on Intel Macs without the T2 chip. A live demo replaces the kernel file in the update snapshot at a log-detected moment, and the rebooted system shows altered output. Other findings include package files missing from the manifest, such as boot components, and a downgrade attack that swaps in an older, Apple-signed update service binary.

The takeaway is that the update path is highly privileged and must treat every file as untrusted until it is verified in a protected location. Apple's fixes include no-follow reads, copying before moving, restricted download directories and fuller manifest coverage. Secure boot remains the main hardware mitigation, and machines without it are the most exposed.