The Achilles Heel of Endpoint Security

The talk looks at Apple's EndpointSecurity framework, which lets third-party tools observe and act on system events on macOS. Every such client needs Full Disk Access before it can register. The speaker argues this is a weak point, because revoking the permission switches the client off. The permission can be cleared with the tccutil utility, which at first offered a reset with no checks, so any user could disable a security product.

The presenter then walks through the first reported issue and the series of Apple mitigations that followed. Each fix was bypassed in turn. An authorization prompt was defeated by editing the authorization database as root, a later check that relied on reading the TCC database was sidestepped, and a mount placed over the client binary made tccutil stop recognising it as a client. An older tccutil build from a previous macOS release still worked. Apple then moved the reset logic into the tccd daemon and added a dedicated TCC permission for EndpointSecurity clients, which the speaker judged a sounder design that still has conditions under which it is weak.

The talk closes by arguing that Full Disk Access is a master permission reaching well beyond TCC, covering private user data, APFS snapshots and administrative config files. Practitioners should treat it as a sensitive grant, avoid giving it to terminals and scripting tools, and watch for a split into finer permissions and a better-protected TCC database.