On October 25, 2023, Apple published a macOS security update addressing a critical permissions vulnerability labeled as CVE-2023-42945. This flaw allowed malicious apps to gain unauthorized Bluetooth access on vulnerable Macs, risking user privacy and device security. Let’s break down what happened, what the technical details are, and how an attacker could exploit the issue—along with some simple code and references.

Apple’s security note (HT213981) simply states

> "A permissions issue was addressed with additional restrictions. An app may gain unauthorized access to Bluetooth. This issue is fixed in macOS Sonoma 14.1."

Severity: High
Impact: Unauthorized app could connect to or monitor Bluetooth devices.

Prior to the patch, macOS did not strictly enforce Bluetooth access permissions. An unprivileged app—without your approval—could scan for nearby devices, connect, and potentially leak sensitive data.

How Did It Work? Simple Technical Breakdown

Normally, apps on macOS must prompt the user and get explicit permission to use Bluetooth. The bug in Sonoma pre-14.1 let certain apps bypass those prompts by abusing the Bluetooth framework APIs under the hood.

Example: Exploiting the Permissions Flaw

Here’s a Swift code snippet that a curious or malicious app might use to scan for nearby Bluetooth devices without prompting for permission (before the patch):

import CoreBluetooth

class BluetoothExploit: NSObject, CBCentralManagerDelegate {
    var centralManager: CBCentralManager?

    override init() {
        super.init()
        centralManager = CBCentralManager(delegate: self, queue: nil)
    }

    func centralManagerDidUpdateState(_ central: CBCentralManager) {
        if central.state == .poweredOn {
            // Start scanning for all nearby devices
            centralManager?.scanForPeripherals(withServices: nil, options: nil)
            print("Scanning for Bluetooth devices...")
        }
    }

    func centralManager(_ central: CBCentralManager, didDiscover peripheral: CBPeripheral,
                       advertisementData: [String: Any], rssi RSSI: NSNumber) {
        print("Discovered device: \(peripheral.name ?? "Unnamed")")
    }
}

Leaking device info: Mapping or profiling nearby devices is possible.

- Potential for further attacks: Follow-on attacks, like spoofing devices or eavesdropping, could be attempted.

Collected data could be shipped off to a remote server for tracking and profiling.

Bottom line: This undermines macOS security and user trust in the Bluetooth ecosystem.

Apple’s Fix

In macOS Sonoma 14.1, Apple put additional restrictions in place. Apps must now properly request user approval to access Bluetooth APIs, and attempts to bypass this are blocked at the system level.

Installing the update is the only fix.

- macOS Sonoma 14.1 update (HT213981)
- Apple Security Releases

References & Further Reading

- CVE-2023-42945 on NVD
- Apple Security Release for macOS 14.1
- Bluetooth Security in Apple Platforms

Conclusion

CVE-2023-42945 exposed a serious gap in macOS Bluetooth permissions. The issue was simple but impactful, potentially letting hackers launch stealth device scans and more. Apple’s prompt fix in Sonoma 14.1 closed the door, but it’s a clear reminder that keeping your Mac updated is critical to stay safe.

---
*Stay secure—update often, trust carefully!*

Timeline

Published on: 02/21/2024 07:15:51 UTC
Last modified on: 08/22/2024 14:35:01 UTC