Design-Based Vulnerabilities on macOS: Oops, Not a One-Shot Fix

Design-Based Vulnerabilities on macOS: Oops, Not a One-Shot Fix

Speakers: Zhongquan Li, Security Researcher, Independent

Conference: OffensiveCon

YouTube: https://www.youtube.com/watch?v=ssmNEPS3s1U

Overview

In his OffensiveCon 2026 presentation, "Design-Based Vulnerabilities on macOS: Oops, Not a One-Shot Fix," independent security researcher Zhongquan Li delved into a series of persistent and high-impact vulnerabilities rooted in fundamental design flaws within macOS security mechanisms. Li's research, conducted between 2024 and 2025, highlights how Apple's layered security often introduces unintended bypasses or leaves core issues unaddressed, leading to attack surfaces that can remain exploitable for extended periods, sometimes years. The talk showcased several powerful techniques, including remote one-click TCC (Transparency, Consent, and Control) bypasses, novel persistence methods leveraging Data Vault protections, and circumventions of macOS's non-atomic operation security.

The central theme of Li's presentation revolved around the concept of "design-based vulnerabilities," emphasizing that their discovery often hinges on understanding the intricate interactions between seemingly unrelated security protections rather than complex exploit development. These flaws, once identified, can be chained to achieve significant compromises, such as gaining full disk access, camera/microphone control, or persistent root access, even against the latest macOS versions. Li's work underscores a critical challenge for platform security: building robust defenses that anticipate and mitigate the complex interplay between different security components, rather than relying on isolated fixes.

This article provides a comprehensive technical breakdown of Li's findings, exploring the mechanisms exploited, the specific techniques developed, and their implications for both macOS users and security professionals. It details how seemingly minor oversights in system design can lead to critical bypasses of core security features like SIP (System Integrity Protection) and TCC, and how Apple's patching strategies sometimes inadvertently create new attack vectors or leave underlying issues unpatched, necessitating a deeper architectural review of macOS security.

Background

▶ Watch: Introduction: Design-based vulnerabilities and long patch times (0:00)

macOS implements a sophisticated, multi-layered security architecture designed to protect user data and system integrity. Unlike Linux, where userland root access often grants unfettered control, macOS introduces additional protections that significantly limit what even a root user can do. Key among these are System Integrity Protection (SIP), Transparency, Consent, and Control (TCC), and Data Vault.

SIP, introduced in macOS El Capitan, is a foundational security feature that restricts the root user from performing certain operations, such as modifying system files, disabling unsigned kernel extension loading, or debugging system processes. Disabling SIP requires rebooting into recovery mode and explicitly opting out, a process designed to prevent malicious software from gaining deep system control. TCC governs access to sensitive user data and hardware, including contacts, photos, camera, microphone, and full disk access. Applications must explicitly request and receive user consent to access these resources. Apple's bounty program historically valued general TCC bypasses more than userland root exploits, highlighting its critical role. Data Vault is a kernel-enforced protection that prevents unauthorized access to specific data, even by a root user with full disk access. It provides an additional layer of integrity for sensitive system directories and files.

Zhongquan Li's research focuses on what he terms "design-based vulnerabilities," which are not about finding traditional memory corruption bugs but rather identifying logical flaws in how these security mechanisms are designed, implemented, and interact with each other. Such vulnerabilities often involve chaining two or more seemingly unrelated security protections to bypass a third. Li notes that these types of vulnerabilities are particularly challenging for Apple to patch, often taking extended periods—sometimes over two years—because they require fundamental design changes rather than simple code fixes. This context sets the stage for understanding the persistence and impact of the vulnerabilities he uncovered.

Key Findings

▶ Watch: macOS security model: TCC and userland root limitations (3:00)

Zhongquan Li's presentation unveiled several critical design-based vulnerabilities on macOS, each demonstrating a sophisticated understanding of the operating system's security architecture and its inherent weaknesses.

1. Remote One-Click TCC Bypass and Persistence: Li demonstrated how malicious packages, even if quarantined, could be leveraged to gain persistent root access and bypass TCC. This was achieved by exploiting the package-script-service component, which possesses powerful entitlements, including com.apple.rootless.install.sandbox. This entitlement allowed the creation of SUID binaries within Data Vault-protected directories (/Library/InstallerSandboxes), rendering them undeletable by standard EDRs or antivirus solutions that only have root and full disk access. Crucially, this persistent root access could then be escalated to general TCC bypass by manipulating app bundles.

1. Abuse of Non-Atomic Operation Security Protection: macOS attempts to secure non-atomic file operations (like file compression/decompression) by creating temporary files in protected folders and performing an atomic rename at the end. Li discovered multiple ways to bypass this protection. Initially, a simple rename of the temporary item folder allowed malicious file injection. More profoundly, he uncovered techniques to exploit Apple's custom XIP (Xcode Installer Package) format, which, despite its security features, exhibited vulnerabilities allowing arbitrary code injection during decompression. This included bypassing sandbox restrictions and, most notably, using inode number emulation to modify files without knowing their full path.

1. MACL (Mandatory Access Control List) Attribute Manipulation for TCC Bypass: Li revealed a technique involving the manipulation of file MACL attributes to bypass App Bundle TCC. By leveraging specific system folders (like Downloads or Documents) to implicitly add a MACL attribute to an app, and then triggering signature verification, it became possible to modify the app's contents even after the App Bundle TCC had supposedly locked it down. This demonstrated that metadata modifications could circumvent integrity checks designed for file data.

1. Critical Clickjacking Vulnerability: Li highlighted a long-standing and fundamental clickjacking vulnerability on macOS, which he argued renders many other security protections "useless." This vulnerability allows an attacker, with an initial shell, to hijack user interactions with legitimate applications (like FaceTime or System Settings) to gain TCC permissions (camera, microphone) or root access. The ease with which fake applications can be registered and prioritized by Launchpad makes this a pervasive and unaddressed threat.

These findings collectively illustrate Li's assertion that design-based vulnerabilities are powerful, long-lasting, and often chain multiple, seemingly disparate security features to achieve their goals, posing a significant challenge to macOS's overall security posture.

Technical Deep Dive

▶ Watch: First vulnerability: Remote TCC bypass and persistence (6:00)

Zhongquan Li's presentation provided a detailed look into the technical intricacies of several macOS vulnerabilities, showcasing how design flaws can be leveraged to bypass core security mechanisms.

Persistence and Remote TCC Bypass via Package Installation

The initial attack vector leverages macOS package installers (.pkg files), which are commonly used for software distribution outside the App Store. Unlike DMG files, package installations typically require root access and can execute pre-install and post-install scripts, fully controlled by the developer.

1. Exploiting package-script-service: When a user installs a package, a component named package-script-service executes these scripts. This service possesses a critical entitlement: com.apple.rootless.install.sandbox. This entitlement grants it the ability to write to and operate within specific system directories that are protected by Data Vault, a kernel-enforced security mechanism.
2. Undeletable SUID Binary: Li demonstrated that by having the package-script-service place a SUID (Set User ID) binary within the Library/InstallerSandboxes folder, the attacker could achieve persistent root access. Due to Data Vault protection, standard antivirus or EDR solutions, even with root and full disk access, could not delete this binary. This creates a highly resilient persistence mechanism.

• Payload: A simple script could chown root:wheel manager and chmod 4755 manager a malicious binary within the Library/InstallerSandboxes directory, making it a persistent root-level backdoor.

1. Bypassing App Bundle TCC with GKTool and Dirty NIBs: Gaining persistent root access is powerful, but macOS's TCC still protects sensitive user data. To bypass TCC, Li targeted how macOS verifies and protects app integrity.

• App Integrity Checks: When an app is first launched, syspolicyd performs a time-consuming signature verification. To prevent modifications after this initial check, Apple implemented App Bundle TCC, which locks the app bundle to prevent further changes.
• Silent Signature Verification: Traditionally, triggering signature verification for an app would involve open command, which is noticeable to the user. However, on macOS 14.0+, Apple introduced GKTool, a command-line utility with a special package-installation entitlement. GKTool scone can silently trigger signature verification without any user interaction or notification.
• Dirty NIB Technique: With Data Vault access (via package-script-service) and the ability to silently trigger signature verification, the next step was to inject a payload without invalidating the app's signature. Li achieved this by modifying XIB (XML Interface Builder) files, which are resource files and do not affect the binary's signature. By parsing the XIB format and injecting an NSScriptObject that executes arbitrary commands (e.g., osascript -e 'do shell script "..."'), the payload would execute automatically when a specific UI element (like a button) was triggered, or even on app launch if designed correctly.
• Targeted TCC Bypasses:
• Screen Capture TCC: By injecting a payload into an app like P-Shadow.app (which legitimately has screen capture entitlements), Li could silently capture the screen.
• General TCC (Full Disk Access): Targeting Xcode.app, which has Apple Event TCC (allowing it to send arbitrary events to other processes), Li could send events to Finder. Since Finder inherently has full disk access, it could be coerced into replacing TCC.db with a malicious database, thereby granting the attacker general TCC bypass.
• Attack Flow: Create a notarized package containing an unmodified victim app. In pre-install/post-install scripts, move the app to Library/InstallerSandboxes, use GKTool to trigger signature verification, then modify the XIB file to inject the payload (leveraging Data Vault bypass for modification). Finally, move the app out of the protected folder for launch.

Non-Atomic Operation Security Protection Bypass

macOS's approach to securing non-atomic file operations (like compression/decompression) involves creating temporary files in protected folders and then performing an atomic rename operation to their final location. This aims to prevent race conditions where an attacker could modify temporary files.

1. Initial Bypass (CVE-XXXX-XXXX): Li found a simple flaw: while temporary files were protected, the temporary folder itself could be renamed. By renaming the original temporary folder, creating a new malicious one in its place, and then allowing the system to write to it, the attacker could inject malicious content.
2. XIP (Xcode Installer Package) Exploits: Li focused on Apple's custom .xip format, which is used for large applications like Xcode and includes signature verification.

• Early XIP Vulnerability: Older versions of XIP placed temporary extracted files directly into /tmp (e.g., /tmp/random_UID), which was not protected by temporary-items rules. This allowed direct modification. Apple patched this by moving temporary XIP extraction to the temporary-items folder.
• Sandbox Bypass for XIP: Li discovered that if the XIP decompression process occurred within a sandboxed application, the sandbox could control its own temporary directory, allowing an attacker to modify the extracted content. While a sandbox typically restricts access to privileged XPC functions, Li noted that custom SBPL (Sandbox Policy Language) rules could be compiled to bypass these restrictions. This vulnerability earned a $47,000 bounty.
• Leaking Full Path and Inode Number Emulation: Even with temporary items protected and random suffixes, Li found ways to bypass.
• Full Path Leakage: During XIP decompression, there's a timing window between when Xcode.app is registered and when a privileged function is called to trust the extracted app. An attacker could continuously dump registered applications to leak the full path of the temporary Xcode.app.
• Inode Number Emulation: This advanced technique allows reading/writing to files without knowing their full path. Every file on a file system has a unique FS ID (File System ID) and an IOD Number. The IOD number increases linearly. By creating two temporary files before and after the target file's creation, Li could establish a range for the target's IOD number. A brute-force attack could then iterate through this range, using FS ID and IOD Number to modify the file directly. This was demonstrated by modifying Xcode.app content during decompression.
• Patch Evolution: Apple's patches for XIP moved temporary folders to group containers, effectively protecting them with an entirely different security mechanism, indicating the difficulty of patching the underlying non-atomic operation design flaw.

MACL Attribute Abuse

MACL (Mandatory Access Control List) attributes are file metadata that define access permissions. Li found that modifying these attributes does not change an app's signature, making them a potential vector for bypasses.

1. Implicit MACL Assignment: Simply moving an app into specific system folders like Downloads or Documents and then moving it back implicitly assigns a MACL attribute to it.
2. App Bundle TCC Bypass: With an app possessing this MACL attribute, Li could trigger signature verification. Even though App Bundle TCC would then "protect" the app, the presence of the MACL attribute allowed for subsequent content modification, bypassing the integrity check.
3. subsistence Folder Bug: Li also identified a separate, interesting bug involving the subsistence folder. Moving a verified app into subsistence, modifying its content, and then moving it back out still allowed the modified content to execute, indicating a gap in how macOS re-verifies or re-applies App Bundle TCC after file system operations involving certain special directories.

Demo / Proof of Concept

▶ Watch: Challenges of installing unauthorized/unnotarized packages (6:40)

Zhongquan Li punctuated his technical explanations with several live demonstrations, illustrating the potency and stealth of the design-based vulnerabilities.

1. Persistent Root Manager: The first demo showcased the creation of a persistent root-level binary. After installing a malicious package, a manager binary was placed in /Library/InstallerSandboxes with SUID privileges. The demo then attempted to delete this binary using commands with root access and full disk access, but it failed due to Data Vault protection, confirming its undeletable nature. The manager binary could be called at any time to regain root.

1. Remote TCC Bypass (Screen Capture): Li demonstrated a remote TCC bypass using the package installation method. After installing a malicious package, the P-Shadow.app was silently modified. Without any visible user interaction or TCC prompts, the system's screen was captured, proving the bypass of the Screen Capture TCC. The only artifact was a brief appearance of the P-Shadow icon in the Dock, which Li explained could be hidden using further tricks like dynamic library hooks or process blocking.

1. Non-Atomic Operation Bypass (File Modification): A simple demonstration showed how renaming a temporary item folder during a compression/decompression operation could lead to file modification. A flag.txt was compressed, the temporary folder was hijacked, and a malicious flag.txt was inserted. Upon decompression, the modified content was revealed, bypassing the intended security.

1. XIP Modification via Inode Brute-Force: This advanced demo showed the modification of Xcode.app during its decompression. First, a temporary file's inode number was recorded. Then, Xcode.xip was decompressed, followed by recording another temporary file's inode number. By brute-forcing the inode numbers within the established range, the content of the extracted Xcode.app was silently modified, demonstrating a powerful bypass of non-atomic protection without knowing the full temporary path.

1. Clickjacking (FaceTime and System Settings): Li presented a stark illustration of the clickjacking vulnerability.

• FaceTime Hijack: With an initial shell, a fake FaceTime application was registered. When the user launched FaceTime from Launchpad, the fake app was launched instead. This fake app then triggered Microphone TCC and Camera TCC prompts, which the user, believing it was the legitimate FaceTime, would likely approve. A photo was then silently taken and saved to /tmp, demonstrating successful camera TCC bypass. Again, a duplicate FaceTime icon appeared in the Dock.
• System Settings Hijack: A more stealthy version was shown for System Settings. A fake System Settings app was registered. When the user opened System Settings, the fake app launched silently, immediately requesting root access. Upon approval, a persistent launch daemon (manager.plist) was installed in /Library/LaunchDaemons with root privileges. Crucially, in this demo, no fake System Settings icon appeared in the Dock, making the attack completely stealthy to the user. Li concluded that the pervasive nature of clickjacking on macOS makes many other security protections effectively useless.

These demonstrations collectively underscored the practical impact of Li's findings, highlighting how design-based vulnerabilities can lead to highly effective and often stealthy compromises of macOS.

Defensive Implications

▶ Watch: Demonstration of root persistence via SUID binary (10:40)

The design-based vulnerabilities highlighted by Zhongquan Li carry significant defensive implications for macOS users, developers, and security professionals.

1. Rethink Endpoint Protection: Traditional Endpoint Detection and Response (EDR) and antivirus solutions often rely on having root access and full disk access to monitor and remediate threats. Li's demonstration of persistent SUID binaries protected by Data Vault in /Library/InstallerSandboxes shows that these tools are fundamentally insufficient against such attacks. EDRs need deeper kernel-level integration or alternative mechanisms to detect and remove threats operating within Data Vault-protected directories.

1. User Vigilance is Paramount for Package Installers: The package installation attack surface is a critical entry point. Users must be extremely cautious about installing .pkg files from untrusted sources, even if they appear to be signed or notarized (as Li showed how these processes can be bypassed or abused). The complex sequence of security prompts and the ability of GKTool to silently trigger signature verification make it difficult for users to discern legitimate from malicious installations.

1. Address Fundamental Design Flaws, Not Just Symptoms: Apple's tendency to patch vulnerabilities by moving attack surfaces to different security protections (e.g., XIP temporary files from /tmp to temporary-items then to group containers) rather than fixing the underlying design flaw (non-atomic operations) creates a whack-a-mole scenario. A more holistic approach to security design is needed, particularly for core primitives like file operations and app integrity.

1. Criticality of Clickjacking: The persistence of clickjacking vulnerabilities on macOS is a severe concern. As Li argues, if an attacker can reliably hijack user clicks to gain TCC permissions or root access, many other layered security controls become moot. Apple needs to fundamentally re-evaluate how applications are registered and launched, and how user interface events are handled, to mitigate this pervasive threat. This is especially true for highly sensitive actions like granting TCC permissions or authenticating for system changes.

1. Developer Awareness of macOS Security Primitives: Developers building macOS applications, especially those distributing outside the App Store, must have a deep understanding of Data Vault, SIP, TCC, and the nuances of package installation. Misconfigurations or assumptions about these protections can inadvertently open doors for attackers. The "Dirty NIB" technique, for instance, highlights how seemingly innocuous resource files can be weaponized.

1. Scrutiny of System Folders and Attributes: The manipulation of MACL attributes and the abuse of special system folders like Downloads, Documents, and subsistence for TCC bypasses indicate that these often-overlooked aspects of the file system can be critical attack surfaces. Security teams should monitor changes to file attributes and access patterns in these directories.

In summary, defenders must recognize that macOS security is complex and that relying on surface-level protections is insufficient. A multi-faceted defense strategy, including improved EDR capabilities, heightened user awareness, and a push for fundamental design improvements from Apple, is essential to counter these sophisticated design-based attacks.

Key Takeaways

• Design-based vulnerabilities are powerful and persistent: These flaws exploit the logical interactions between macOS security features rather than memory corruption, making them difficult to patch and often exploitable for years across multiple macOS versions.
• TCC bypasses are a high-value target: Despite layered protections, techniques like abusing package-script-service with Data Vault and GKTool combined with "Dirty NIBs" can lead to silent, remote TCC bypasses for sensitive resources like screen capture, camera, microphone, and full disk access.
• Non-atomic operations remain a weak point: macOS's attempt to secure non-atomic file operations through atomic renames and protected temporary folders has been repeatedly bypassed, notably through inode number emulation, demonstrating that the underlying design is still vulnerable.
• Clickjacking is a critical, unaddressed vulnerability: The ease with which attackers can register fake applications to hijack user interactions for TCC permissions or root access renders many other macOS security protections ineffective, highlighting a fundamental design flaw in user interaction and application launching.
• Apple's patching process can be opaque and inconsistent: Vulnerabilities are sometimes addressed silently without credit or bounty, or patches inadvertently create new attack surfaces. This can deter researchers and prolong the lifespan of design-based flaws.
• Chaining security mechanisms is a potent attack strategy: The most effective attacks demonstrated involve creatively combining seemingly unrelated security features (e.g., package-script-service entitlements, Data Vault, GKTool, and XIB modification) to achieve impactful compromises.

About the Speaker(s)

Zhongquan Li is an independent security researcher with a specialized focus on the security of Android and macOS operating systems. He has a history of identifying novel vulnerabilities, particularly those that stem from fundamental design flaws rather than traditional exploit development. Three years prior to this OffensiveCon 2026 presentation, in 2023, Li was primarily an Android security researcher, with a proposal on Android Trusted Execution Environment (TE) application backing and fuzzing selected by OffensiveCon, though he was unable to present at that time. His research for "Design-Based Vulnerabilities on macOS" was conducted between 2024 and 2025, during which he delved deep into macOS security mechanisms, uncovering a series of impactful and persistent vulnerabilities. Li is known for his analytical approach to security, often uncovering issues that Apple takes significant time to patch due to their design-based nature. He also has a positive, albeit sometimes frustrating, experience with Apple's bug bounty program, having received substantial payouts for his discoveries despite occasional silent fixes.