Microsoft has released details on a security vulnerability that the company discovered in macOS Ventura. The vulnerability, which Microsoft dubbed “Migraine,” involved Apple’s Migration Assistant and allows a hacker to get by macOS’s System Integrity Protection and get access to the data on the Mac.
In a blog post, Microsoft provides the technical details on how Migraine works. Apple’s SIP provides security for macOS to stop unauthorized root access, but the Migration Assistant app has a privilege that allows it to have unrestricted root access. Microsoft created a modified version of Migration Assistant that takes advantage of this exploit, but the modified app had to be used while the Mac’s Setup Assistant is in debug mode. Microsoft’s researchers were able to use the exploit and then run an AppleScript that mounted a Time Machine backup with infected data, which was transferred to the Mac.
The Migraine vulnerability uses Migration Assistant to obtain root access on an infected Mac.
Apple
Documented as CVE-2023-32369 in the CVE.report database, Apple fixed “Migraine” with the macOS Ventura 13.4, macOS Monterey 12.6.6, and macOS Big Sur 11.7.7 updates released about two weeks ago and is noted in Apple’s security notes. It is customary for security researchers to publish their findings after Apple has fixed the vulnerability. In the Impact section, Apple says the flaw could allow an app to modify protected parts of the file system.
To see if the update is installed, check Software Update in System Settings/Preferences. You can also install the update from there. Installation requires an internet connection and the update is over 2GB, so you need to set aside some time to download, install, and restart your Mac.
Apple has protections in place within macOS and the company releases security patches through OS updates, so it’s important to install them as soon as possible. Macworld has several guides to help keep your Mac safe, including a guide on whether or not you need antivirus software, a list of Mac viruses, malware, and trojans, and a comparison of Mac security software.
Author: Roman Loyola, Senior Editor
Roman has covered technology since the early 1990s. His career started at MacUser, and he's worked for MacAddict, Mac|Life, and TechTV.