macOS 'Migraine' Exploit Capable of Bypassing System Integrity Protection Detected by Microsoft

Microsoft identified the exploit in a macOS tool used to migrate data from a Windows PC to a Mac, or from one Mac to another.

Advertisement
Written by David Delima, Edited by Siddharth Suvarna | Updated: 31 May 2023 17:59 IST
Highlights
  • Microsoft detected a flaw that could allow modification of system files
  • System Integrity Protection was first introduced on macOS in 2015
  • Apple has patched the security vulnerability with macOS 13.4
macOS 'Migraine' Exploit Capable of Bypassing System Integrity Protection Detected by Microsoft

Users who have updated to macOS 13.4 should be protected against the Migraine exploit

Photo Credit: Apple

Microsoft recently detected a security exploit that could allow attackers to bypass a core security feature on computers running on macOS. Dubbed "Migraine", the vulnerability can be used to sidestep Apple's System Integrity Protection (SIP) on macOS — a feature that protects parts of the operating system related to system integrity by restricting access to certain files — and install malware on a victim's computer. Microsoft warned Apple about the security flaw and the Cupertino company has patched the flaw with its latest security update.

According to details shared by Microsoft in a blog post, the "Migraine" security exploit relies on Migration Assistant, a tool provided by Apple to allow users to transfer files from one Mac to another or from a Windows PC to a Mac. The Migration Assistant app from Apple has unrestricted root access that allows it to perform its data transfer function, and security researchers at Microsoft leveraged the special 'entitlement' given to the tool, for the exploit.

After modifying the Migration Assistant to run without logging off a user, Microsoft was able to run the tool in debug mode to bypass a signature check. The company used a 1GB Time Machine backup with malicious software, using a script to cause Migration Assistant to import the backup and infect the host system. The entire process bypassed the System Integrity Protection feature that was first introduced on macOS in 2015.

Microsoft's modified Migration Assistant can function without signing out
Photo Credit: Microsoft

Advertisement

 

It is worth noting that the Migration Assistant is typically available during user setup, which means that an attacker would need to have local access to a machine. Microsoft says that the arbitrary system bypasses like Migraine could create files that are protected by SIP, the same mechanism that it bypasses, making deletion very difficult. Attackers can also run arbitrary kernel code and tamper with the system to enable rootkits. Microsoft adds that these exploits can also be used to gain access to private data as well as computer accessories and devices.

Advertisement

Users who have updated their computers to macOS 13.4 after it was rolled out on May 18 should be safe from the exploit, which has been patched by Apple. Microsoft disclosed the security flaw to Apple, allowing the firm to roll out a fix for the issue. Meanwhile, the company has thanked Microsoft's Jonathan Bar Or, Anurag Bohra, and Michael Pearse for identifying the exploit.


Google I/O 2023 saw the search giant repeatedly tell us that it cares about AI, alongside the launch of its first foldable phone and Pixel-branded tablet. This year, the company is going to supercharge its apps, services, and Android operating system with AI technology. We discuss this and more on Orbital, the Gadgets 360 podcast. Orbital is available on Spotify, Gaana, JioSaavn, Google Podcasts, Apple Podcasts, Amazon Music and wherever you get your podcasts.
Affiliate links may be automatically generated - see our ethics statement for details.
 

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.

Advertisement

Related Stories

Popular Mobile Brands
  1. Oppo K13 Turbo, K13 Turbo Pro Specifications Teased Ahead of Launch Today
  2. OnePlus Could Unveil a Compact Flagship Tablet Alongside the OnePlus 15T
  3. Vivo Y50m 5G, Vivo Y50 5G With 6,000mAh Battery Launched: All Details
  4. Vodafone Idea (Vi) Gives Extra Benefits With These Prepaid Plans: Report
  5. Redmi Note 15 Pro+, iQOO Z10 Specifications Tipped Ahead of Debut
  6. Redmi Turbo 5 Launch and Specifications Tipped: All Details
  7. FromSoftware Is Reportedly Working on a New Game That Could Launch Next Year
  1. Samsung Galaxy Z Fold 8 Might Not Feature Upgraded Titanium Backplate Included With Galaxy Z Fold 7: Report
  2. Samsung Galaxy Tab A11 LTE Version Reportedly Surfaces on FCC, IMEI Certification Websites
  3. Asus Vivobook 14 Launched in India With Snapdragon X Processor, 14-Inch LCD Screen: Price, Specifications
  4. Meta Says It Won't Sign EU’s GPAI Code of Practice Due to ‘Legal Uncertainties’
  5. OnePlus Teases Launch of New Tablet in India on July 23; OnePlus Pad Lite Expected to Debut
  6. Redmi Note 15 Pro+, iQOO Z10 Tipped to Feature Snapdragon Chipsets, 1.5K Resolution Displays
  7. Ubisoft's Upcoming Launches Include a New Ghost Recon Game, CEO Says
  8. Samsung Galaxy Watch 8, Watch 8 Classic Now Available for Pre-Order in India
  9. Vodafone Idea (Vi) Rolls Out Additional Benefits With Rs. 199, Rs. 179 Prepaid Plans: Report
  10. Netflix Reportedly Used AI-Generated Scene in The Eternaut Show to Cut Production Costs
Gadgets 360 is available in
Download Our Apps
Available in Hindi
© Copyright Red Pixels Ventures Limited 2025. All rights reserved.