macOS Vulnerabilities: A Year of Security Research at Kandji

Kandji security researchers have been hard at work hunting for vulnerabilities in macOS, reporting them to Apple before malicious actors can exploit them. This proactive approach is a cornerstone of our product strategy, benefiting not just our customers but the entire Apple ecosystem.

Why We Invest in Proprietary Vulnerability Research

When we discover weaknesses before attackers do, everyone wins. History has shown that vulnerabilities like Gatekeeper bypass and TCC bypass zero-days don't remain theoretical for long—both of these recent vulnerabilities were exploited in the wild by macOS malware. By investing heavily in new security research, we're helping strengthen macOS for everyone.

Once reported to Apple, the fix for these vulnerabilities is not always obvious. Depending on the complexity, it can take a few months to over a year, especially if it requires major architectural changes to the operating system. Apple’s vulnerability disclosure program has been responsive and effective.

Of course, we don't just report issues and walk away. We ensure our products can detect these vulnerabilities and protect our customers from potential exploitation while waiting for official patches.

In this post, we provide a brief overview of the macOS vulnerabilities our team discovered and reported to Apple, which Apple addressed in subsequent security updates. We will also explore how Kandji protects customers from these vulnerabilities, even before patches become available.

Storage Daemons

Nothing keeps us up at night like the thought of a threat actor achieving full sandbox breakout, gaining highest privileges, and accessing a user’s personal documents. Yet, Kandji researchers managed to demonstrate exactly that in a proof-of-concept submitted to Apple.

macOS uses two very powerful daemons to manage disks and mount operation:

diskarbitrationd handles mounting.
storagekitd has broader capabilities, such as disk repair.

Both processes run as root, and have powerful entitlements which allow them to bypass other system security protections, like System Integrity Protection (SIP) or Transparency, Consent, and Control (TCC).

Given the history of vulnerabilities in diskarbitrationd, as discussed in our History of Disk Arbitration Vulnerabilities talk at the MacSysAdmin conference, we continually explore this area. Our efforts uncovered four significant issues:

These vulnerabilities were remarkably broad in scope—potentially enabling sandbox escape, local privilege escalation, and even TCC bypass. When chained together, they form a ridiculously powerful weapon in the hands of a malicious actor.

For those interested in the technical details, we covered these findings in depth in our three-part blog series "Uncovering Apple Vulnerabilities: diskarbitrationd and storagekitd Audit" (Part 1, Part 2, Part 3 ) and presented at international conferences like Black Hat Europe and Power of Community.

Screenshot 2025-04-22 at 9.43.24 AM

Installer Packages

How do you drive a security researcher to the brink of insanity? Have them analyze an entire software catalog of close to 10,000 installers.

macOS installer packages are prime targets for exploitation because the system installer daemon (system_installd) doesn't just run with root privileges—it can bypass SIP's file system protection and write to locations few other processes can access.

If a threat actor exploits the installation process, they’ll enjoy the same level of privileges: modify protected parts of the file system, persist in protected locations, you name it. Security products don’t even have access to clean up here. We wrote about this in more detail in our How Apple Mitigates Vulnerabilities in Installer Scripts blog post.

After analyzing Apple’s entire software catalog (yes, really), we discovered three exploitable installer packages, resulting in SIP bypass:

We will be sharing more details on these discoveries at the MacDevOpsYVR 2025 conference in the “Finding Vulnerabilities in Apple Packages at Scale” talk.

Privacy Holes

While the following vulnerabilities didn’t allow us to fully bypass the TCC subsystem, they still allowed access to private data.

CVE-2024-54477 allowed us to access all user private data through the system restore functionality.
CVE-2024-40783 allowed us to access all data on Time Machine backups, essentially equivalent to all private data access.

Although both of these issues granted us read-only access, they are still a major concern. Apple is heavily working on locking down such access.

Finally, we found several smaller TCC info leaks or limited TCC bypasses, which led to private data accessible in places which were not protected by the system:

These vulnerabilities allowed us to read music libraries, modify applications, access filenames, or capture screenshots—all without proper authorization.

Beyond macOS: Discovering Privilege Escalation in Twitch

While we primarily focus on macOS, we occasionally assess third-party applications. One such case involved Twitch, where we identified a local privilege escalation vulnerability in the application's privilege helper tool.

Unfortunately, since the vendor no longer maintains this product, it will never be officially fixed. Even when users delete the non-functional application, the privilege helper often remains. We published our findings to raise awareness and urge users to manually remove this component.

How Kandji Protects You

Reporting vulnerabilities benefits the entire community once patches are available, but what about the months (or even year) before fixes arrive? That's where Kandji provides additional value.

Cutting-edge Protection in Kandji EDR

We leverage our proprietary knowledge of these exploits to build detection capabilities into our EDR product—bringing customers protection long before the vulnerability is disclosed publicly, and a fix becomes available.

We also develop behavioral detections that follow techniques used in these exploits—enabling us to mitigate novel exploits without ever having seen them.

We have discovered dozens of macOS exploits that, as of this date, have not been publicly disclosed or patched, but which Kandji customers are protected against.

New EDR Card

Broader Detections in Kandji Vulnerability Management

The proactive companion to threat detection is ensuring that vulnerable software is patched. Researchers often publish exploits immediately after vendors release patches for vulnerabilities, these exploits quickly become known across the cybercriminal community—making timely software updates essential.

Kandji Vulnerability Management now identifies vulnerabilities in macOS alongside installed applications on Mac computers. This addition to the product shines a light on the security holes stemming from vulnerable OS versions on your computers.

Looking Ahead

Our security researchers are already deep into 2025, with 41 pending reports awaiting Apple's remediation. This ongoing work is about staying ahead of attackers, and it's making a difference—previously exploited zero-days like GateKeeper and TCC bypasses have been found and fixed through our collaborative efforts.

While some fixes take time, especially those requiring architectural changes, we commend Apple's responsiveness and value our continued partnership.

Through responsible disclosure and advanced product integration, Kandji is committed to securing the Apple ecosystem—not just for our customers, but for everyone.