Transparency, Consent and Control (TCC) is the macOS privacy and security mechanism that decides whether a running process may use protected data or services, such as screen sharing, the camera, the microphone or Full Disk Access (FDA). MITRE tracks the abuse of it as T1548.006, TCC Manipulation, a privilege escalation technique.
How attackers use it
When an application asks for a protected resource, the TCC daemon, tccd, checks the TCC database at /Library/Application Support/com.apple.TCC/TCC.db (and the home directory equivalent). It also checks an overrides file when the Mac is connected to MDM. If no permission exists, the user is prompted. Once granted, the database remembers it and does not ask again unless it is reset.
MITRE documents two abuse paths.
- Borrowing an app that already has permission. Examples are Process Injection, or running a malicious binary through another application. MITRE's example is Finder, a native app with FDA: a malicious AppleScript run under Finder inherits access to all files without a prompt.
- Editing the database itself. When System Integrity Protection (SIP) is disabled, TCC protections are disabled too. On such a system, an adversary can add permissions for their own executable by loading an adversary-controlled TCC database using environment variables and
launchctl.
How to detect it
MITRE's detection strategy looks for unauthorized modification of TCC.db followed by elevated process execution under a trusted parent such as Finder or SystemUIServer, or through a launchctl environment override. It also flags SIP being disabled, which MITRE calls highly uncommon and a prerequisite for the database path.
That last point is useful. SIP state is cheap to inventory, and a disabled SIP on a managed fleet is worth an alert by itself.
How to reduce the risk
MITRE lists three mitigations.
- Audit: routinely review applications using Automation under Security and Privacy settings. Users can reset permissions with the
tccutil resetcommand, and with MDM you can review the enabled and disabled applications in the MDM overrides file that takes precedence over the database. - Privileged Account Management: remove unnecessary users from the local administrator group.
- Restrict File and Directory Permissions: with MDM, grant only what each binary needs, and limit Full Disk Access to the binaries that need it under policy.
Check your own environment
A read-only check of SIP on one Mac.
csrutil status
It should report that System Integrity Protection is enabled. Then review which apps hold Full Disk Access in your MDM profiles and ask whether each one still needs it.
Quick check
Why is a disabled SIP important to this technique?
With SIP disabled, TCC protections are disabled too, which allows an adversary to load a TCC database they control.
Sources
- MITRE ATT&CK, Abuse Elevation Control Mechanism: TCC Manipulation: https://attack.mitre.org/techniques/T1548/006
