Skip to content
attack.paths
Anmelden
← RegistryDossier · 5 steps · 4 edges

TCC bypass → access Photos / Camera without consent

Inject into a process that already has Full Disk Access (e.g. backup utility, Terminal). Inherited TCC entitlement lets the attacker code read TCC-gated data — Photos, iMessage DB, Documents.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: foothold as a standard user on macOS. At least one third-party app on the system has been granted FDA. SIP enabled (default) but the attacker has user-level write to the app bundle / dylib search path.

§ Steps

  1. 01
    User shellInitial Access
    T1078— Valid Accounts
  2. 02
    Find app with FDA / Photos / Camera consentDiscovery
    T1087— Account Discovery
  3. 03
    Exfil Photos / iMessage / DocumentsCredential Access
    T1552— Unsecured Credentials
  4. 04
    Inherit entitlements → read TCC-protected dataDefense Evasion
    MAC-TCC-BYPASS— TCC Bypass
  5. 05
    Dylib hijack into the consented appPrivilege Escalation
    MAC-DYLIB-HIJACK— Dylib Hijack

§ References

§ Frequently asked

What is the "TCC bypass → access Photos / Camera without consent" attack path?
Inject into a process that already has Full Disk Access (e.g. backup utility, Terminal). Inherited TCC entitlement lets the attacker code read TCC-gated data — Photos, iMessage DB, Documents. It chains 5 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is User shell (T1078) — a initial access primitive. Assumed environment: foothold as a standard user on macOS.
What is the final impact of this kill-chain?
The final step lands on Dylib hijack into the consented app (MAC-DYLIB-HIJACK), which falls under Privilege Escalation. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers