The Clock is TCCing

The talk opens with a quick look at Apple's Transparency, Consent and Control (TCC) framework, which gates application access to resources such as the microphone, camera and protected folders. The speakers explain how the TCC daemon consults several stores, including user and system databases, MDM overrides and app entitlements, before deciding on a request.

From an attacker's perspective, they outline three routes: inheriting Full Disk Access through a terminal, abusing bugs in legitimate applications to borrow their grants, and wearing users down with repeated prompts. They point out that permissions are keyed to bundle identifiers rather than versions, that prompts reveal little, and that no usage history exists. For visibility, they mine the unified log written by the daemon, using six structured entry types that link a request to its responsible, accessing and requesting processes and the outcome. Log formats shift subtly between macOS releases, which they tracked with a CI matrix.

They introduce Kronos, an open-source tool that enriches TCC prompts with the requesting binary path and PID, keeps a searchable usage history, shows signing details, and lets users revoke grants after a time limit or when an app quits. It also uses Endpoint Security to alert on direct edits to the user TCC database. Planned work covers bug fixes, version-aware permissions and UI improvements, and the speakers suggest Apple could publish TCC events through Endpoint Security.