Unexpected, Unreasonable, Unfixable: Filesystem Attacks on macOS

The talk looks at how file operations on macOS can be abused through logic bugs rather than memory corruption. The speaker explains why races, symlink-following calls, rename behaviour and user-mountable disk images open paths that classic Unix hardening does not cover, and why the newer permission layers on macOS sit on top of decades of POSIX assumptions.

Five of the seven findings are walked through with demos. One abuses a rename in a logging path to overwrite the TCC database and gain automation access. A debug query log in a bundled SQLite build follows symbolic links, and the speaker shows how extra tables can be planted in an application's own database. Spotlight's indexing of user-mounted volumes is turned into a file write against sudoers, using hex-edited volumes and union mounts. A malloc stack logging environment variable forces a file write that a setuid crontab then leaks through an inherited file descriptor, yielding root.

The closing takeaway is that file-system isolation between users or processes is needed for a real security boundary, and that letting unprivileged users mount attacker-controlled volumes widens the attack surface considerably. The speaker presents the work as a repeatable methodology, and notes that the reported issues have since been addressed.