Who Cares Where Waldo is. Locating macOS Users Without their Consent

The talk examines how macOS decides which apps may read a user's location. Location permissions sit in a separate subsystem from the general privacy database, with their own store and daemon, and access checks lean heavily on an app's code signing requirement. The speaker argues that this design has architectural weaknesses that can be abused.

Several attack routes are walked through. A copied app kept its location access when run from a temporary folder, and older signed builds with injected libraries passed the same check, enabling downgrade attacks. Child processes inherit their parent's permissions. Other paths included leaks through logs and crashes, a proxy setup flow that dropped the certificate prompt, a browser automation technique that returned coordinates, and a Safari web archive that exposed location before a fix. Some of these issues needed several Apple patches to close.

The closing argument is that attackers may not need a macOS zero-day, because some third-party apps share location with any app that asks. For defenders, the talk recommends flagging apps launched from unusual directories, checking for injected libraries and inherited-permission indicators, and monitoring how browsers are instrumented.