What Happens on your Mac, Stays on Apple's iCloud?!

The talk looks at how macOS protects personal data with System Integrity Protection and the Transparency, Consent, and Control framework, which prompts the user before apps reach documents, contacts and similar resources. Entitlements add another layer. The speaker explains that they are checked against the running process, so code injected into a trusted process can inherit that process's rights.

Building on that, the speaker examines an iCloud helper service that hands out account tokens to clients holding a private iCloud entitlement. Two Apple applications with that entitlement, GarageBand and iMovie, could be used to load a malicious dynamic library, because GarageBand disabled library validation and iMovie lacked hardened runtime. With the tokens in hand, the speaker showed that location, contacts, calendar and reminder data could be requested directly from iCloud over HTTP, with no prompts and no root access. Apple has since fixed the issue by blocking those apps through launch requirements. The research is still open for notes, photos and messages, which use protobuf.

For defenders, the takeaway is that data synchronized to iCloud can be reached through a compromised app's token path, not only through the local protections. Keeping macOS updated and reviewing which data types are synced to iCloud, such as mail, contacts or photos, reduces that exposure.