USB-C Accessories Need User Permission to Communicate With Apple Silicon Macs Running macOS Ventura

[MacRumors]

With macOS Ventura, there's a new USB-C security feature designed for Apple silicon Macs. As described by Apple in the macOS Ventura release notes (via The Verge), USB-C and Thunderbolt accessories connected to the USB-C port on an Apple silicon Mac will require explicit user permission before the accessory can communicate with macOS.

On portable Mac computers with Apple silicon, new USB and Thunderbolt accessories require user approval before the accessory can communicate with macOS for connections wired directly to the USB-C port. This doesn't apply to power adapters, standalone displays, or connections to an approved hub. Devices can still charge if you choose Don't Allow.

You can change the security configuration in System Settings > Security and Privacy > Security. The initial configuration is Ask for new accessories. Configuring an accessibility Switch Control sets the policy to always allow accessory use. Approved devices can connect to a locked Mac for up to three days.

Accessories attached during software update from prior versions of macOS are allowed automatically. New accessories attached prior to rebooting the Mac might enumerate and function, but won't be remembered until connected to an unlocked Mac and explicitly approved.

The user permission restriction does not apply to power adapters, standalone displays, or connections to an approved hub, so it will not impact the use of displays or chargers, and it can be toggled off if desired.

macOS Ventura is available to developers at the current time, with a public beta planned for July.

Article Link: USB-C Accessories Need User Permission to Communicate With Apple Silicon Macs Running macOS Ventura

 

[zakarhino]

Underrated simple idea that might help mitigate chargers with malware.

 

[dave420]

Yes good idea. The type of thing that makes you wonder why it wasn't always there.

 

[jimthing]

Anything new/fixed/improved in Music app on macOS... nothing reported so far?

 

[rorschach]

Good idea. But what happens if your keyboard and mouse suddenly stop working (it happens) and you need to plug in USB ones? How will you "approve" them?

 

[jz0309]

Good move

 

[CarAnalogy]

Good idea. But what happens if your keyboard and mouse suddenly stop working (it happens) and you need to plug in USB ones? How will you "approve" them?

I wondered the same. But all my peripherals are USB-A. Doesn’t mention if it applies to that or not.

Though the more I think about it it should somehow because the “Bad USB” exploit of pretending to be a keyboard is one of the main things this should prevent.

 

[locovaca]

Good idea. But what happens if your keyboard and mouse suddenly stop working (it happens) and you need to plug in USB ones? How will you "approve" them?

“Hey Siri, approve my keyboard.”

maybe this is why you can dictate punctuation now?

 

[antiprotest]

Good idea. But what happens if your keyboard and mouse suddenly stop working (it happens) and you need to plug in USB ones? How will you "approve" them?

Your local Apple store will tell you the problem is within "accepted tolerance" and refuse to help you.

 

[InGen]

Thank you Apple, a much needed and common sense security feature that until now without has allowed exploiters a weak-point at which to direct their attacks. A truly portless and seamless wireless environment for our devices is on the horizon

 

[jimbobb24]

If it’s like how the phone interacts with my Mac it will need permission annoyingly every time. That would be a big hassle.

 

[lcubed]

gotta wonder how that will work with the usb-c smart card reader we use for user authentication at work.

 

[Mr. Dee]

Ever since my M1 MBP killed my G-Drive I have not connected to replacement I got, even to do just a standard Time Machine backup. I plan on getting a dedicated external drive for it, but I am not using my current drive because I use it to backup my Windows device and Intel Mac.

 

[ios-dan]

Not being sarcastic, but why is this a good thing? Are we guarding against random bad actors plugging stuff into my laptop while I’m at out in a public place? What is the risk that is being protected?

 

[BootsWalking]

Good idea. But what happens if your keyboard and mouse suddenly stop working (it happens) and you need to plug in USB ones? How will you "approve" them?

One idea could be to require whoever attached the keyboard to type the user's login password on it to grant it access to the system.

 

[BootsWalking]

I wondered the same. But all my peripherals are USB-A. Doesn’t mention if it applies to that or not.

Though the more I think about it it should somehow because the “Bad USB” exploit of pretending to be a keyboard is one of the main things this should prevent.

Would still apply since these Macs only have USB-C connections and the only way to get a USB device attached is through them (even if using a USB-A to USB-C dongle).

 

[BootsWalking]

Not being sarcastic, but why is this a good thing? Are we guarding against random bad actors plugging stuff into my laptop while I’m at out in a public place?

Yes

What is the risk that is being protected?

Exploiting any vulnerability in the USB software stack on the system.

 

[exoticSpice]

Good idea. But what happens if your keyboard and mouse suddenly stop working (it happens) and you need to plug in USB ones? How will you "approve" them?

This is from the article "Configuring an accessibility Switch Control sets the policy to always allow accessory use"

 

[dmylrea]

If this is for security, then how am I (an unsuspecting victim) supposed to know NOT to allow a USB drive I am plugging in that seems perfectly safe to me? I say "Allow" and BAM! I'm still a victim. Or is this to stop usb-c driving from plugging themselves in when I'm not around?

 

[jav6454]

Nice unannounced feature.

 

[exoticSpice]

Or is this to stop usb-c driving from plugging themselves in when I'm not around?

This.

 

[dmylrea]

Yes

Exploiting any vulnerability in the USB software stack on the system.

But, how does the user know they are being exploited when "allowing" the device? Most devices don't say "This contains malware" on them...won't everyone just "allow" everything they themselves are plugging in?

What am I missing?

 

[HeroOfTime32]

Good idea. But what happens if your keyboard and mouse suddenly stop working (it happens) and you need to plug in USB ones? How will you "approve" them?

The article refers specifically to portable computers, which now have fingerprint authentication.

 

[CarAnalogy]

Would still apply since these Macs only have USB-C connections and the only way to get a USB device attached is through them (even if using a USB-A to USB-C dongle).

Can’t delete post so editing. Seems this is only for portables.

 

[rorschach]

The article refers specifically to portable computers, which now have fingerprint authentication.

Touch ID requires entering the password after a restart though.