Safety Chunk: Apple addresses privateness issues round Notification Heart database in macOS Sequoia (Replace)

9to5Mac Safety Chunk is solely dropped at you by Mosyle, the one Apple Unified Platform. Making Apple gadgets work-ready and enterprise-safe is all we do. Our distinctive built-in strategy to administration and safety combines state-of-the-art Apple-specific safety options for totally automated Hardening & Compliance, Subsequent Era EDR, AI-powered Zero Belief, and unique Privilege Administration with essentially the most highly effective and trendy Apple MDM available on the market. The result’s a very automated Apple Unified Platform at the moment trusted by over 45,000 organizations to make tens of millions of Apple gadgets work-ready with no effort and at an inexpensive price. Request your EXTENDED TRIAL in the present day and perceive why Mosyle is every part it’s worthwhile to work with Apple.

The privateness implications of Notification Heart popups are well-known within the safety forensics group. Whether or not a consumer likes it or not, macOS quickly retains a log of each notification acquired in a single plaintext database. This may embody messages from functions like iMessage, Slack, Groups, and nearly anything.

Nonetheless, it now seems Apple has moved the Notification Heart database in macOS Sequoia to handle issues.

Replace: Csaba Fitzl has shared a straightforward method to view these notifications saved in plaintext from Terminal. This script on GitHub permits you to learn all of the notification data from the database.

A few notes: Earlier than you may run the .sh script, it’s possible you’ll have to make it executable. Use the next instructions…

cd /path/to/the/script

chmod +x parse_notificationdb_records.sh

./parse_notificationdb_records.sh /path/to/your/com.apple.notificationcenter/db2/db file

For those who’re not on the Sequoia beta, you will discover your notificationcenter db path beneath. After that, the script ought to start to execute and show current notification particulars.

If you’re not utilizing the macOS Sequoia developer beta, you will discover your notifications in an SQLite database positioned at /non-public/var/folder. To entry this, open Finder, press Shift + CMD + G, after which enter “/var/folder.” Inside, you will note two folders with random letters as their names. Inside every of those folders, one can find directories containing consumer (0), cache (C), and momentary (T) information. Click on by means of the primary two folders, then “0,” and navigate to the com.apple.notificationcenter file. It’s right here you’ll discover the .db file.

If you double-click to open or run the “strings” command on this file, you’ll uncover a heap of knowledge, together with binary knowledge and “NS” class names, in addition to your iMessages, file paths, Slack, X, Fb, and another notifications despatched to Notification Heart by an app or the system, all seen in plaintext.

For those who don’t wish to undergo all these steps, you may shortly discover your final notification from the com.apple.notificationcenter file by punching this command into Terminal:

DA=`getconf DARWIN_USER_DIR`; sqlite3 $DA/com.apple.notificationcenter/db2/db "choose hex(knowledge) from file order by delivered_date desc restrict 1;" | xxd -r -p - | plutil -p -

The excellent news? Apple seems to have lastly acknowledged that storing iMessage knowledge in a folder with out the consumer’s data or consent isn’t the perfect observe.

First noticed by safety researcher Csaba Fitzl (also called “theevilbit” in the neighborhood), macOS Sequoia strikes the Notification Heart database inside Group Containers. Particularly below ~/Library/Group Containers/group.com.apple.usernoted/db2/db.

Not like in non-public/var/folders (the present location), Group Containers are protected by TCC (Transparency, Consent, and Management) prompts. This contains iMessage knowledge, which Apple considers non-public info. You’ve possible encountered these prompts earlier than. TCC manages permissions associated to varied assets, resembling permitting an software to make use of your Mac’s microphone or digicam. On this case, it enhances privateness by making certain that delicate message content material isn’t inadvertently uncovered.

This can be a nice step by Apple towards defending consumer privateness, particularly in the case of messages. Higher [4 years] late than by no means.