Quick Security Update

SuperDuper 4.0.10 includes a security update that addresses a recently reported CVE.

macOS Privacy Protection (TCC¹)

Normally, on your startup drive, macOS protects personal information (Contacts, Documents, and the like) behind security prompts that I’m sure you’ve seen. When an Application tries to access the data, the user is prompted to confirm that’s what they want.

Snapshots

When SuperDuper copies an APFS drive, it snapshots the content of the drive to “freeze” it (so you don’t have to worry about using the drive while you’re backing it up). SuperDuper mounts that at a temporary location.

The problem

The problem is that TCC protects the startup drive’s contents at their normal location, not in a snapshot.² Since SuperDuper mounted the snapshot at an accessible location, a bad actor could watch for those mounts and access TCC-protected content without the user being prompted to allow it.

The solution

SuperDuper 4.0.10 now mounts the snapshot in an inaccessible, root-owned location, so only software already running with administrator (root) privileges can reach it.

The risk

All normal POSIX permissions still applied to the mount, so files that wouldn’t normally be accessible (leaving TCC aside) were (and are) still fully protected. However, malicious software running under your account could watch for the snapshot mount during a backup and read your TCC-protected files without a prompt.

Note that the backup itself is copying the protected files (it wouldn’t be much of a backup if it did not), and TCC does not protect those files on the backup save for restricting access to all external drives on a per-Application basis.

This fix protects access to the snapshot of the source drive. All external devices, like backup drives, have a single gate. Once permission is granted for an application, the files are only protected from it by POSIX permissions, ACLs, etc…and then, only when Ignore ownership on this volume is not on.

Download available

You can install SuperDuper 4.0.10 through the normal update mechanism, or by downloading and installing directly.

As always: thanks for using SuperDuper!