ELECTRONizing macOS Privacy - a New Weapon in Your Red Teaming Armory

The talk looks at macOS Transparency, Consent and Control (TCC), the framework that gates access to sensitive resources such as files, the camera, microphone and screen capture. It explains that user decisions are stored in per-user SQLite databases, and that permissions granted to an application can pass down to the processes it spawns. Many Electron-based programs, including chat clients, code editors and developer tools, are installed from the internet and usually hold such permissions, which makes them a useful route in.

The speaker described how Electron apps pair an embedded web view with a bridge to native system APIs, and how default settings can allow code to be injected into a running app through its developer tools debugging interface. A free, open-source tool was shown that lists installed Electron apps, checks whether they are vulnerable, and injects predefined or custom JavaScript. Demonstrations included a shell spawned from Visual Studio Code reaching a protected desktop folder, a camera capture through Microsoft Teams, and a screenshot taken through an older Slack build. Because injection leaves the main binary untouched, it sidesteps the app protection added in macOS Ventura. Electron fuses can disable the debugging flag, but the code signing requirements stored for TCC only identify the publisher, not the app version, which keeps downgrade attacks viable.

For defenders, the main recommendation is detection, such as monitoring endpoint security exec events for Electron processes launched with the inspect flag. The speaker argued that a complete fix has to come from Apple, since developers cannot protect their own apps against this behaviour.