macOS Mail App Vulnerability Makes Your Encrypted Emails Readable

Apple Mail logo

A vulnerability in Apple’s macOS Mail app could allow a hacker to read parts of your email despite them being encrypted. The vulnerability was allegedly reported to Apple a few months ago and yet the company is yet to fix it.

The vulnerability was discovered by Bob Gendler, an IT specialist. He reported the issue to Apple on July 29 and received a reply from the company as well. He noted that the issue affects macOS 10.14 and the latest macOS Catalina beta. Over the next two days, he informed Apple that the vulnerability also exists in macOS 10.13.6 and 10.12.6.

The vulnerability affects only a limited number of people and it requires them to be using macOS, using Apple Mail and sending encrypted mails using it, and not using FileVault to encrypt their Mac. A hacker with proper knowledge of macOS and its system files can retrieve at least parts of the mail due to this vulnerability.

The main thing I discovered was that the snippets.db database file in the Suggestions folder stored my emails. And on top of that, I found that it stored my S/MIME encrypted emails completely UNENCRYPTED. Even with Siri disabled on the Mac, it *still* stores unencrypted messages in this database!

When Apple’s security team never got around to fixing the issue until the end of October, Bob ended up emailing Tim Cook about it. After that, he got a response from Apple’s Enterprise Support on disabling Siri integration for Apple Mail. This can be done by going to System Preferences -> Siri -> Siri Suggestions & Privacy -> Mail and toggling the feature off.

What’s worrying is that despite the vulnerability being reported to Apple over 3 months ago, the company never got around to fixing it. The company rolled out multiple macOS updates during this timeframe including some major security updates so its puzzling to see Apple sit on this issue for so long. Whatever the case might be, with the issue now being reported publicly, it is a matter of time before Apple rolls out an update to fix this vulnerability.

[Via The Verge]