Microsoft Threat Intelligence disclosed a macOS vulnerability, tracked as CVE-2024-44133 and dubbed “HM Surf,” that bypasses the operating system’s Transparency, Consent, and Control (TCC) framework. The flaw abuses Apple Safari’s private entitlements (com.apple.private.tcc.allow), which allow the native browser to access sensitive resources without generating standard system prompts. Attackers invoke the dscl command-line utility to alter the current user’s NFSHomeDirectory attribute, temporarily stripping TCC protections from ~/Library/Safari. This allows unprivileged processes to tamper directly with Safari preference databases, including PerSitePreferences.db, injecting arbitrary origin permissions for the device camera, microphone, geolocation, and browsing history before restoring the home path.

Telemetry from Microsoft Defender detected in-the-wild activity linked to the macOS adware family Adload mimicking this technique, silently whitelisting hardware permissions and executing Safari in concealed windows to drop second-stage payloads. Apple resolved CVE-2024-44133 in macOS Sequoia 15 by removing the defective configuration routines.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: First-party private entitlements weaken operating system sandboxing. By abusing directory path redirection to rewrite trusted application configuration stores, adversaries turn privileged browser capabilities into silent surveillance primitives that bypass endpoint behavioral heuristics.
• Bullet 2 — Strategic & Defender Imperative: Enterprise defenders must accelerate updating endpoints to macOS Sequoia 15, restrict local directory service utilities via MDM policies, and audit process telemetry for unauthorized dscl home path modifications.