Wojciech Reguła: Bypassing macOS Privacy via Electron Apps
A DEF CON 31 talk on bypassing macOS privacy protections through the TCC (Transparency, Consent, and Control) system, which governs app access to sensitive data like files, camera, and microphone.
The researcher demonstrates how misconfigurations in Electron applications can be abused to execute code within their context and inherit already granted TCC permissions.
The talk introduces an open-source tool for red team testing and discusses possible detection methods for such attacks.
The researcher demonstrates how misconfigurations in Electron applications can be abused to execute code within their context and inherit already granted TCC permissions.
The talk introduces an open-source tool for red team testing and discusses possible detection methods for such attacks.