3 ms·

I understand that this is considered a vulnerability on iOS, since its security model includes isolating applications from each other. But does macOS even atte

I understand that this is considered a vulnerability on iOS, since its security model includes isolating applications from each other. But does macOS even attempt to sandbox applications like that? I assumed it's like Windows/Linux where traditionally applications have full access to a user's data and it only attempts to protect data of other users. On Windows/Linux attempts to introduce such isolation have seen little adoption so far. Has Apple been more successful on macOS?

ChocolateGod 2y ago
Yes, Mac app store applications have a sandbox that restricts access to user files unless the user authorized it. https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox https://book.hacktricks.xyz/macos-hardening/macos-security-a...
upon_drumhead 2y ago
There is some sandboxing on Mac. For example, there is a bunch of permissions around Full Disk Access that prevents a rogue app from getting full access to all your files without your approval
olliej 2y ago
macOS has sandboxing in the "prevent attacker from escalating from the compromised process" sense. It also has the concept of data that can only be read by apps that have the correctly rights - as in even if a process is running as root, the process cannot access the data. It sounds like someone found some way to access the history data, and because they're not supposed to be able to, there's a CVE. Of course if there was no attempt to protect the browsing history so anything/one could read it, then that would not be a vulnerability, so that's fun :-/ (as analogy: one company releases a car with a key required to open+drive, another company releases a car with no locks that anyone can get into a drive off with, and then someone finds a way to pick the lock on the former).

ChocolateGod 2y ago

Yes, Mac app store applications have a sandbox that restricts access to user files unless the user authorized it. https://book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-security-protections/macos-sandbox https://book.hacktricks.xyz/macos-hardening/macos-security-a...

upon_drumhead 2y ago

There is some sandboxing on Mac. For example, there is a bunch of permissions around Full Disk Access that prevents a rogue app from getting full access to all your files without your approval

olliej 2y ago

macOS has sandboxing in the "prevent attacker from escalating from the compromised process" sense. It also has the concept of data that can only be read by apps that have the correctly rights - as in even if a process is running as root, the process cannot access the data. It sounds like someone found some way to access the history data, and because they're not supposed to be able to, there's a CVE. Of course if there was no attempt to protect the browsing history so anything/one could read it, then that would not be a vulnerability, so that's fun :-/ (as analogy: one company releases a car with a key required to open+drive, another company releases a car with no locks that anyone can get into a drive off with, and then someone finds a way to pick the lock on the former).