Silent Apple Account Persistence in macOS Sonoma

Executive Summary

This vulnerability is a correctness issue in macOS Sonoma that allows an attacker with physical access to silently persist an Apple Account on a device even after it has been erased. This means the account remains active and could potentially be used for unauthorized access.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability requires physical access to exploit and is addressed by updating to macOS Sonoma 14.8.8. Detection involves checking the macOS version and verifying no unauthorized Apple Accounts persist after erasure. Use 'sw_vers' to check the OS version and review system logs for unexpected account persistence.

Useful 0 Not Useful 0

Impact Analysis

If someone gains physical access to your device, they could exploit this flaw to keep your Apple Account active on an erased device. This could lead to unauthorized access to your data or services linked to that account.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker with physical access to silently persist an Apple Account on an erased device, which could lead to unauthorized data access or persistence. This may impact compliance with standards requiring data erasure or secure device handling, such as GDPR's right to erasure or HIPAA's device disposal requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Update to macOS Sonoma 14.8.8 or later to address the issue. Ensure devices are fully erased and verified before disposal or transfer.

Useful 0 Not Useful 0