Editing MacOS (section)

== Security ==
Apple publishes Apple Platform Security documents to lay out the security protections built into macOS and Mac hardware.<ref>{{Cite web |title=Apple Platform Security |url=https://support.apple.com/en-gb/guide/security/welcome/web |access-date=2023-02-12 |website=Apple Support |language=en |archive-date=February 12, 2023 |archive-url=https://web.archive.org/web/20230212160614/https://support.apple.com/en-gb/guide/security/welcome/web |url-status=live }}</ref>

macOS supports additional hardware-based security features on Apple silicon Macs:<ref name=":3">{{Cite web |title=Explore the new system architecture of Apple silicon Macs - WWDC20 - Videos |url=https://developer.apple.com/videos/play/wwdc2020/10686/ |access-date=2023-02-12 |website=Apple Developer |language=en |archive-date=February 12, 2023 |archive-url=https://web.archive.org/web/20230212160614/https://developer.apple.com/videos/play/wwdc2020/10686/ |url-status=live }}</ref>
* [[W^X|Write xor execute]] prevents some security vulnerabilities by making [[Page (computer memory)|memory pages]] either writable or executable, but not both.<ref name=":3" />
* [[PCI Express|PCIe]] or [[Thunderbolt (interface)|Thunderbolt]] devices are prevented by [[Input–output memory management unit|IOMMUs]] from reading system memory that is not explicitly mapped to them, unlike Intel-based Macs.<ref name=":3" /><ref>{{Cite web |title=Direct memory access protections for Mac computers |url=https://support.apple.com/en-gb/guide/security/seca4960c2b5/web |access-date=2023-02-12 |website=Apple Support |language=en |archive-date=February 12, 2023 |archive-url=https://web.archive.org/web/20230212160616/https://support.apple.com/en-gb/guide/security/seca4960c2b5/web |url-status=live }}</ref>

macOS's optional Lockdown Mode enables additional protections, such as disabling [[just-in-time compilation]] for Safari's [[JavaScript engine]], blocks FaceTime calls unless you have previously called that person or contact, location information is excluded when photos are being shared, Game Center is disabled, and accessories have to be approved and your Mac has to be unlocked. These prevent some vulnerabilities within macOS.<ref>{{Cite web |title=Apple's Lockdown Mode offers extreme security for iPhone, iPad, and Mac |url=https://www.macworld.com/article/801510/apple-devices-lockdown-mode-extreme-protection.html |access-date=2023-02-12 |website=Macworld |language=en |archive-date=February 12, 2023 |archive-url=https://web.archive.org/web/20230212160616/https://www.macworld.com/article/801510/apple-devices-lockdown-mode-extreme-protection.html |url-status=live }}</ref>

Only the latest major release of macOS (currently [[macOS Sequoia]]) receives patches for all known security vulnerabilities. The previous two releases receive some security updates, but not for all vulnerabilities known to Apple. In 2021, Apple fixed a critical [[privilege escalation]] vulnerability in macOS Big Sur, but a fix remained unavailable for the previous release, macOS Catalina, for 234 days, until Apple was informed that the vulnerability was being used to infect the computers of [[Hong Kong]] citizens and other people who visited [[Politics of Hong Kong|Hong Kong]] [[Pro-democracy camp (Hong Kong)|pro-democracy]] websites that may have been [[Internet censorship in Hong Kong|blocked in Hong Kong]].<ref>{{Cite web |last=Cunningham |first=Andrew |date=2021-11-12 |title=PSA: Apple isn't actually patching all the security holes in older versions of macOS |url=https://arstechnica.com/gadgets/2021/11/psa-apple-isnt-actually-patching-all-the-security-holes-in-older-versions-of-macos/ |access-date=2023-02-12 |website=Ars Technica |language=en-us |archive-date=January 1, 2023 |archive-url=https://web.archive.org/web/20230101032826/https://arstechnica.com/gadgets/2021/11/psa-apple-isnt-actually-patching-all-the-security-holes-in-older-versions-of-macos/ |url-status=live }}</ref><ref>{{Cite web |last=Schneier |first=Bruce |date=October 31, 2022 |title=Apple Only Commits to Patching Latest OS Version |url=https://www.schneier.com/blog/archives/2022/10/apple-only-commits-to-patching-latest-os-version.html |access-date=2023-09-28 |website=Schneier on Security |archive-date=September 27, 2023 |archive-url=https://web.archive.org/web/20230927024810/https://www.schneier.com/blog/archives/2022/10/apple-only-commits-to-patching-latest-os-version.html |url-status=live }}</ref>

[[macOS Ventura]] added support for Rapid Security Response (RSR) updates and Lockdown Mode. Rapid Security Response updates may require a reboot, but take less than a minute to install.<ref>{{cite web |last1=Lawler |first1=Richard |title=Apple's first iPhone Rapid Security Response patch had a problem, but it's fine now |url=https://www.theverge.com/2023/5/1/23706883/apple-ios-16-iphone-rapid-security-update-error-internet-connection |website=The Verge |access-date=2 May 2023 |date=1 May 2023 |archive-date=May 2, 2023 |archive-url=https://web.archive.org/web/20230502110617/https://www.theverge.com/2023/5/1/23706883/apple-ios-16-iphone-rapid-security-update-error-internet-connection |url-status=live }}</ref><ref>{{Cite web |last=Cunningham |first=Andrew |date=2023-05-01 |title=Apple uses iOS and macOS Rapid Security Response feature for the first time |url=https://arstechnica.com/gadgets/2023/05/seven-months-in-ios-and-macos-get-their-first-rapid-security-updates/ |access-date=2023-09-28 |website=Ars Technica |language=en-us |archive-date=October 3, 2023 |archive-url=https://web.archive.org/web/20231003045158/https://arstechnica.com/gadgets/2023/05/seven-months-in-ios-and-macos-get-their-first-rapid-security-updates/ |url-status=live }}</ref> In an analysis, [[Hackintosh]] developer Mykola Grymalyuk noted that RSR updates can only fix userland vulunerability, and cannot patch the macOS kernel.<ref>{{cite web |last1=Grymalyuk |first1=Mykola |title=macOS' Rapid Security Response: Designed into a Corner |url=https://khronokernel.github.io/macos/2023/04/18/RSR.html |website=Mykola's blog |access-date=2 May 2023 |language=en |date=18 April 2023 |archive-date=May 2, 2023 |archive-url=https://web.archive.org/web/20230502110622/https://khronokernel.github.io/macos/2023/04/18/RSR.html |url-status=live }}</ref> Lockdown Mode is an optional security feature designed to provide extreme protection for users who may be at risk of targeted cyberattacks, such as journalists, activists, and public figures. This mode significantly alters the functionality of the device to enhance security against sophisticated threats, particularly from spyware and state-sponsored attacks. Apple says most people are never impacted by these attacks.<ref>{{Cite web |title=About Lockdown Mode |url=https://support.apple.com/en-us/105120 |access-date=2024-10-19 |website=Apple Support |language=en}}</ref>

=== Malware and spyware ===
{{Main|macOS malware}}

In its earlier years, Mac OS X enjoyed a near-absence of the types of [[malware]] and [[spyware]] that have affected [[Microsoft Windows]] users.<ref>{{Cite magazine |last=Welch |first=John |date=January 6, 2007 |title=Review: Mac OS X Shines In Comparison With Windows Vista |url=https://www.informationweek.com/news/showArticle.jhtml?articleID=196800670&pgno=4 |url-status=live |magazine=Information Week |archive-url=https://web.archive.org/web/20070209090401/https://www.informationweek.com/news/showArticle.jhtml?articleID=196800670 |archive-date=February 9, 2007 |access-date=February 5, 2007 |df=mdy-all}}</ref><ref>{{Cite web |last=Granneman |first=Scott |date=October 6, 2003 |title=Linux vs. Windows Viruses |url=https://www.theregister.co.uk/2003/10/06/linux_vs_windows_viruses |url-status=live |archive-url=https://web.archive.org/web/20150907054536/https://www.theregister.co.uk/2003/10/06/linux_vs_windows_viruses |archive-date=September 7, 2015 |access-date=February 5, 2007 |website=The Register |df=mdy-all}}</ref><ref>{{Cite web |last=Gruber |first=John |author-link=John Gruber |date=June 4, 2004 |title=Broken Windows |url=https://daringfireball.net/2004/06/broken_windows |url-status=live |archive-url=https://web.archive.org/web/20110904003214/https://daringfireball.net/2004/06/broken_windows |archive-date=September 4, 2011 |access-date=April 24, 2006 |publisher=[[Daring Fireball]] |df=mdy-all}}</ref> macOS has a smaller usage share compared to Windows.<ref>{{Cite web |date=September 2009 |title=Operating System Market Share |url=https://marketshare.hitslink.com/operating-system-market-share.aspx?qprid=8 |url-status=live |archive-url=https://web.archive.org/web/20100125022803/https://marketshare.hitslink.com/operating-system-market-share.aspx?qprid=8 |archive-date=January 25, 2010 |access-date=April 10, 2009 |df=mdy-all}}</ref> [[Computer worm|Worms]], as well as potential vulnerabilities, were noted in 2006, which led some industry analysts and anti-virus companies to issue warnings that Apple's Mac OS X is not immune to malware.<ref>{{Cite magazine |last=Roberts |first=Paul |date=February 21, 2006 |title=New Safari Flaw, Worms Turn Spotlight on Apple Security |url=https://www.eweek.com/security/new-safari-flaw-worms-turn-spotlight-on-apple-security |url-status=live |magazine=[[eWeek]] |archive-url=https://web.archive.org/web/20220927142109/https://www.eweek.com/security/new-safari-flaw-worms-turn-spotlight-on-apple-security/ |archive-date=September 27, 2022 |access-date=January 22, 2022}}</ref> Increasing market share coincided with additional reports of a variety of attacks.<ref>{{Cite web |last=Conneally |first=Tim |date=August 28, 2009 |title='Macs don't get viruses' myth dissolves before public's eyes |url=https://www.betanews.com/article/Macs-dont-get-viruses-myth-dissolves-before-publics-eyes/1251493625 |url-status=live |archive-url=https://web.archive.org/web/20090830174605/https://www.betanews.com/article/Macs-dont-get-viruses-myth-dissolves-before-publics-eyes/1251493625 |archive-date=August 30, 2009 |publisher=BetaNews |df=mdy-all}}</ref> In early 2011, Mac OS X experienced a large increase in malware attacks,<ref>{{Cite magazine |last=Grimes |first=Roger A. |date=May 23, 2011 |title=7 questions about the Mac malware scare &#124; Security |url=https://www.infoworld.com/d/security/7-questions-about-the-mac-malware-scare-811 |url-status=live |magazine=InfoWorld |archive-url=https://web.archive.org/web/20110607094531/https://www.infoworld.com/d/security/7-questions-about-the-mac-malware-scare-811 |archive-date=June 7, 2011 |access-date=July 5, 2011 |df=mdy-all}}</ref> and malware such as [[Mac Defender]], MacProtector, and MacGuard was seen as an increasing problem for Mac users. At first, the malware installer required the user to enter the administrative password, but later versions installed without user input.<ref>{{Cite web |date=May 26, 2011 |title=Mac Security Boasts Threatened by Malware Surge – International Business Times |url=https://www.ibtimes.com/articles/152612/20110526/mac-security-boasts-threatened-by-malware-surge.htm |url-status=dead |archive-url=https://web.archive.org/web/20110808024312/https://www.ibtimes.com/articles/152612/20110526/mac-security-boasts-threatened-by-malware-surge.htm |archive-date=August 8, 2011 |access-date=July 5, 2011 |publisher=Ibtimes.com |df=mdy-all}}</ref> Initially, Apple support staff were instructed not to assist in the removal of the malware or admit the existence of the malware issue, but as the malware spread, a support document was issued. Apple announced an OS X update to fix the problem. An estimated 100,000 users were affected.<ref>{{Cite web |last=Trenholm |first=Rich |date=May 20, 2011 |title=Apple tells support staff not to confirm Mac Defender infections |url=https://www.cnet.com/news/apple-tells-support-staff-not-to-confirm-mac-defender-infections |url-status=live |archive-url=https://web.archive.org/web/20210622224013/https://www.cnet.com/news/apple-tells-support-staff-not-to-confirm-mac-defender-infections/ |archive-date=June 22, 2021 |access-date=March 21, 2020 |publisher=CNET}}</ref><ref>{{Cite news |last=Seltzer |first=Larry |date=May 25, 2011 |title=Mac Defender 2.0 Released – Security Watch |work=PC Mag |url=https://blogs.pcmag.com/securitywatch/2011/05/mac_defender_20_released.php |url-status=dead |access-date=July 5, 2011 |archive-url=https://web.archive.org/web/20110717145838/https://blogs.pcmag.com/securitywatch/2011/05/mac_defender_20_released.php |archive-date=July 17, 2011 |df=mdy-all}}</ref> Apple releases security updates for macOS regularly,<ref>{{Cite web |date=January 21, 2009 |title=Apple security updates |url=https://support.apple.com/kb/HT1222 |url-status=live |archive-url=https://web.archive.org/web/20090205004031/https://support.apple.com/kb/HT1222 |archive-date=February 5, 2009 |access-date=January 29, 2009 |publisher=Apple |df=mdy-all}}</ref> as well as signature files containing [[signature-based detection|malware signatures]] for [[Xprotect]], an anti-malware feature part of [[File Quarantine]] present since Mac OS X Snow Leopard.<ref>{{Cite web |date=May 18, 2015 |title=XProtect Explained: How Your Mac's Built-in Anti-malware Software Works |url=https://www.howtogeek.com/217043/xprotect-explained-how-your-macs-built-in-anti-malware-works |url-status=live |archive-url=https://web.archive.org/web/20180323030541/https://www.howtogeek.com/217043/xprotect-explained-how-your-macs-built-in-anti-malware-works |archive-date=March 23, 2018 |publisher=How-To Geek |df=mdy-all}}</ref>