{"id":30904549,"url":"https://github.com/gastonmorixe/macos-serial-number-leak","last_synced_at":"2026-05-13T12:50:53.339Z","repository":{"id":311053141,"uuid":"1042295203","full_name":"gastonmorixe/macos-serial-number-leak","owner":"gastonmorixe","description":"PoC macOS Serial Number leak without user consent using IOKit kIOPlatformSerialNumberKey","archived":false,"fork":false,"pushed_at":"2025-08-21T20:08:25.000Z","size":23,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-08-21T21:59:09.407Z","etag":null,"topics":["apple","apple-security","mac","macos","security","tracking"],"latest_commit_sha":null,"homepage":"https://developer.apple.com/documentation/iokit/kioplatformserialnumberkey","language":"Swift","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/gastonmorixe.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-08-21T19:35:53.000Z","updated_at":"2025-08-21T20:08:31.000Z","dependencies_parsed_at":"2025-08-21T22:09:22.694Z","dependency_job_id":null,"html_url":"https://github.com/gastonmorixe/macos-serial-number-leak","commit_stats":null,"previous_names":["gastonmorixe/macos-serial-number-leak"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/gastonmorixe/macos-serial-number-leak","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gastonmorixe%2Fmacos-serial-number-leak","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gastonmorixe%2Fmacos-serial-number-leak/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gastonmorixe%2Fmacos-serial-number-leak/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gastonmorixe%2Fmacos-serial-number-leak/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/gastonmorixe","download_url":"https://codeload.github.com/gastonmorixe/macos-serial-number-leak/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gastonmorixe%2Fmacos-serial-number-leak/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":274275266,"owners_count":25254903,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-09T02:00:10.223Z","response_time":80,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["apple","apple-security","mac","macos","security","tracking"],"created_at":"2025-09-09T09:34:50.173Z","updated_at":"2025-10-24T13:11:36.237Z","avatar_url":"https://github.com/gastonmorixe.png","language":"Swift","funding_links":[],"categories":[],"sub_categories":[],"readme":"## macOS Serial Number Leak\n\nA Swift PoC that reads the Mac’s hardware serial number without user consent. Apple's Mac serial number is a durable, globally unique identifier. Unrestricted access via public [`IOKit`'s `kIOPlatformSerialNumberKey`](https://developer.apple.com/documentation/iokit/kioplatformserialnumberkey) APIs enables tracking and cross-app correlation. This PoC demonstrates the current behavior up to macOS 2025 Sequoia 15.7 (24G214). Update: tested in macOS 26 beta 7 and stills happening.\n\n\u003cp align=\"center\"\u003e\n\u003cimg width=\"727\" height=\"414\" alt=\"Screenshot 2025-08-21 at 7 25 49 PM\" src=\"https://github.com/user-attachments/assets/3095495e-5680-4d5d-a254-8a3f4d6e99b5\" /\u003e\n\u003c/p\u003e\n\n### Tiny PoC (Swift)\n```swift\nimport Foundation\nimport IOKit\n\n// Read Mac serial from IORegistry via IOKit (public API)\nlet match = IOServiceMatching(\"IOPlatformExpertDevice\")!\n\nlet service = IOServiceGetMatchingService(kIOMainPortDefault, match)\nguard service != 0 else {\n    fputs(\"Unable to access IORegistry\\n\", stderr)\n    exit(EXIT_FAILURE)\n}\ndefer { IOObjectRelease(service) }\n\nlet value = IORegistryEntryCreateCFProperty(\n    service,\n    kIOPlatformSerialNumberKey as CFString, // \u003c\u003c\u003c==\n    kCFAllocatorDefault,\n    0\n)?.takeRetainedValue()\n\nif let serial = (value as? String), !serial.isEmpty {\n    print(\"Serial:\", serial)\n} else {\n    print(\"Serial unavailable\")\n}\n```\n\n### Requirements\n- **Platform**: macOS 10.15+\n- **Toolchain**: SwiftPM (bundled with Xcode). Works with recent Xcode/Swift versions\n\n### Quick start\n```bash\n# Build (debug)\nswift build\n\n# Run CLI (debug)\nswift run serial-number\n\n# Build (release) and run\nswift build -c release\n./.build/release/serial-number\n```\n\n### Makefile shortcuts\n```bash\nmake help          # list tasks\nmake build         # swift build (debug)\nmake release       # swift build -c release\nmake run           # swift run serial-number (debug)\nmake run-release   # run release binary\nmake test          # run tests\nmake test-coverage # run tests with coverage enabled\nmake coverage      # print a coverage summary\nmake coverage-show # annotated per-line coverage for Sources\nmake format        # run swift-format if installed\nmake lint          # run SwiftLint if installed\nmake clean         # remove build artifacts\nmake install-local # copy CLI to ~/.local/bin/serial-number\n```\n\n### Usage (library)\n```swift\nimport SerialNumberCore\n\nif let serial = getSerialNumber() {\n  print(\"Serial: \\(serial)\")\n} else {\n  print(\"Serial unavailable\")\n}\n```\n\n### What it does\n- Queries `IORegistry` for `IOPlatformExpertDevice` and reads `kIOPlatformSerialNumberKey` using IOKit\n- Public API: `getSerialNumber() -\u003e String?`\n- Internal helper for testability: `extractSerialNumber(from: CFTypeRef?) -\u003e String?`\n\nReferences:\n- [IOKit overview](https://developer.apple.com/documentation/iokit)\n- [IORegistry programming concepts](https://developer.apple.com/documentation/iokit/ioregistry)\n\n### Tests\n- Frameworks: XCTest + Swift Testing\n- Behavior: tests are deterministic; they do not skip. On macOS, they validate when a serial is available it is non-empty, length ∈ (4, 64). In constrained environments (e.g., sandbox/CI runners) `getSerialNumber()` returning `nil` is accepted.\n\nRun:\n```bash\nswift test\n```\n\n### Coverage\n```bash\n# Enable and run tests with coverage\nmake test-coverage\n\n# Summary report (requires Xcode toolchain)\nmake coverage\n\n# Per-line annotated view for Sources\nmake coverage-show\n```\n\n### CLI behavior\n- Success: prints the serial to stdout; exit 0\n- Failure: prints a human-readable error to stderr; exit 1\n\n### Scripts\n- `Scripts/integration_test.sh`: builds a tiny integration binary with `swiftc` and verifies the CLI-like behavior without SwiftPM caches\n\n### Files of interest\n- `Sources/SerialNumberCore/SerialNumberCore.swift`: `getSerialNumber()` and `extractSerialNumber(from:)`\n- `Sources/serial-number/serial_number.swift`: CLI `@main`\n- `Tests/SerialNumberCoreTests/…`: XCTest + Swift Testing suites\n- `Makefile`: developer shortcuts\n- `Package.swift`: SwiftPM manifest (links `IOKit`)\n\n# macOS Serial Number Privacy Gap - Research\n\n**Apple maintains a significant privacy inconsistency between macOS and iOS regarding hardware serial number access, creating security concerns that remain largely unaddressed.** While iOS strictly controls hardware identifier access through technical restrictions and user consent mechanisms, macOS applications can freely read device serial numbers without user notification or permission. This disparity has generated growing concern among security researchers and privacy advocates, though public awareness remains limited.\n\n## Community awareness reveals growing privacy concerns\n\nResearch across Reddit forums, Hacker News discussions, and developer communities shows **mounting concern about unlimited serial number access** by macOS applications. The most significant discovery came from Mac refurbisher RDKL Inc., which found that [macOS El Capitan and newer automatically transmit serial numbers to Apple's servers for verification](https://www.rdklinc.com/blog/2019/03/does-apple-verify-our-serial-numbers-against-a-database-every-time-we-connect-to-the-internet), regardless of user privacy settings during setup. This \"heartbeat to the mothership\" occurs even when users explicitly opt out of data sharing.\n\nCommunity discussions highlight several problematic scenarios: malicious cache-cleaning apps logging Mac serial numbers, scammers using legitimate serial numbers for eBay fraud, and corporate devices becoming unusable due to unreleased Device Enrollment Program registrations. **Most concerning is the low public awareness** - many macOS users remain unaware that any application can access their hardware serial number, contrasting sharply with iOS users who receive clear permission prompts for similar access attempts.\n\nThe technical community has documented these concerns extensively. [Security guides on GitHub](https://github.com/drduh/macOS-Security-and-Privacy-Guide) consistently warn that macOS Recovery Mode \"exposes the serial number and other identifying information over the network in plain text\" during OS installation. Multiple privacy-focused repositories highlight serial number exposure as a fundamental macOS privacy weakness.\n\n## Technical prevention methods face significant limitations\n\nDespite community concerns, **preventing serial number access on macOS proves technically challenging** with most solutions requiring substantial security trade-offs. Current approaches fall into several categories, each with critical limitations.\n\n**System-level protections show limited effectiveness.** App Sandbox restrictions from the Mac App Store can limit some applications, but sophisticated apps bypass these controls using direct IOKit API calls or command-line tools like `ioreg`. The Transparency, Consent, and Control (TCC) framework, which manages many macOS privacy permissions, notably lacks any specific protection for hardware serial number access.\n\n**Third-party security tools offer partial solutions.** [Little Snitch](https://vlaicu.io/posts/little-snitch/) ($59) can block applications from transmitting serial numbers over the network but cannot prevent local access. [BlockBlock](https://www.macworld.com/article/228879/first-look-little-flocker-and-blockblock-help-monitor-your-macs-security.html) monitors persistent software installation to detect potential malware but doesn't directly control hardware identifier access. These tools provide monitoring and network-level protection rather than access prevention.\n\n**Advanced technical methods require significant security compromises.** Modifying [System Integrity Protection (SIP)](https://support.apple.com/guide/security/system-integrity-protection-secb7ea06b49/web) or developing custom kernel extensions can theoretically block serial number access, but these approaches severely compromise macOS security and system stability. On Apple Silicon Macs, such modifications require [\"Reduced Security\" mode](https://support.apple.com/guide/mac-help/change-security-settings-startup-disk-a-mac-mchl768f7291/mac), fundamentally altering the security model.\n\n**Enterprise environments lack comprehensive controls.** Configuration profiles and Mobile Device Management (MDM) policies cannot directly restrict serial number access. This creates a paradox since enterprise management systems rely on serial numbers for device identification - blocking access could interfere with legitimate management functions.\n\nThe most practical approach combines network monitoring tools with careful application management rather than attempting system-level blocking. However, **no solution provides comprehensive protection** without significant security or functionality trade-offs.\n\n## Security researchers highlight fundamental privacy architecture flaws  \n\nThe cybersecurity community has extensively documented macOS serial number access as a significant privacy vulnerability. Security researcher \"Sick Codes\" has demonstrated how [hardware identifiers can be easily manipulated and generated](https://github.com/sickcodes/osx-serial-generator), creating tools that produce thousands of valid serial numbers for security research purposes. This research reveals the fundamental reliance on serial numbers throughout Apple's ecosystem.\n\n**Penetration testing professionals routinely exploit serial number access** for reconnaissance and system profiling. The [`ioreg -l | grep IOPlatformSerialNumber` command](https://apple.stackexchange.com/questions/40243/how-can-i-find-the-serial-number-on-a-mac-programmatically-from-the-terminal) provides direct access to hardware identifiers, making it a standard tool for red team operations and malware analysis. [Digital forensic analysts](https://r1971d3.medium.com/macos-attack-matrix-gathering-system-information-using-ioplatformexpertdevice-part-2-8162f3b83415) document that macOS malware routinely accesses serial numbers for anti-analysis evasion and unique victim identification.\n\nAcademic research confirms that **hardware identifiers enable precise device fingerprinting** when combined with other system characteristics. [Studies show](https://www.researchgate.net/publication/317930445_OS_Fingerprinting_New_Techniques_and_a_Study_of_Information_Gain_and_Obfuscation) macOS devices can be reliably fingerprinted using hardware identifiers, creating persistent tracking capabilities across applications and browsing sessions.\n\nThe [Mysk security research team](https://mysk.blog/2024/05/03/apple-required-reason-api/) has documented significant enforcement gaps in Apple's privacy policies, finding that popular applications continue sending hardware identifiers despite declaring approved reasons in their privacy manifests. This research demonstrates the disconnect between Apple's stated policies and actual technical enforcement on macOS.\n\n## Apple's intentional platform divergence reflects different priorities\n\nApple maintains fundamentally different hardware identifier policies between iOS and macOS by design, not oversight. **iOS implements strict technical restrictions** at the operating system level, requiring explicit user consent through the App Tracking Transparency framework and severely limiting access to device serial numbers, UDID, and other unique identifiers. [App Store Review Guidelines](https://adguard.com/en/blog/apple-device-fingerprinting-rules.html) actively enforce these restrictions with app rejections for unauthorized access attempts.\n\n**macOS preserves traditional desktop computing access patterns** with broader API availability and developer responsibility rather than technical enforcement. While the same App Store guidelines theoretically apply, macOS provides significantly more system access through IOKit and command-line tools. This reflects Apple's positioning of macOS as a \"professional\" platform requiring greater system access for development, enterprise management, and system administration.\n\nThe rationale appears multi-faceted: macOS serves enterprise environments requiring device identification for asset management, supports developers who need hardware access for testing and system management, and maintains the traditional Unix-style system access patterns expected from desktop computers. **Apple has not announced plans to align macOS privacy controls with iOS standards**, suggesting this divergence is intentional and likely permanent.\n\nRecent privacy initiatives like the [2024 Privacy Manifests requirement](https://adguard.com/en/blog/apple-device-fingerprinting-rules.html) apply to both platforms but show continued enforcement differences. The trajectory suggests gradual privacy enhancements on macOS while maintaining essential differences that preserve professional computing capabilities.\n\n## Conclusion\n\nThe macOS serial number access issue represents a **fundamental privacy architecture choice** by Apple rather than an oversight. While security researchers and privacy advocates have clearly documented the risks, Apple's business and technical decisions prioritize maintaining macOS as an open development and enterprise platform over implementing iOS-level privacy restrictions.\n\nFor users seeking protection, the most effective approach combines network monitoring tools, careful application management, and awareness rather than attempting system-level modifications. However, the underlying privacy gap remains unaddressed, creating an ongoing tension between Apple's privacy leadership on iOS and its more permissive approach on macOS. This disparity will likely persist as Apple balances privacy protection with the professional computing requirements that distinguish macOS from iOS.\n\n---\n\n## References\n\n- [iOS Serial Number Access Restrictions - Stack Overflow](https://stackoverflow.com/questions/24505664/how-to-find-serial-number-imei-number-using-ios-sdk)\n- [Apple's Required Reason API and Device Fingerprinting - Mysk Blog](https://mysk.blog/2024/05/03/apple-required-reason-api/)\n- [Apple Serial Number Tracking Investigation - RDKL Inc.](https://www.rdklinc.com/blog/2019/03/does-apple-verify-our-serial-numbers-against-a-database-every-time-we-connect-to-the-internet)\n- [macOS Serial Number Access Question - Ask Different](https://apple.stackexchange.com/questions/254813/is-an-app-on-mac-able-to-know-my-serial-number)\n- [macOS Security and Privacy Guide - GitHub](https://github.com/drduh/macOS-Security-and-Privacy-Guide)\n- [Little Snitch Network Monitor Review](https://vlaicu.io/posts/little-snitch/)\n- [System Integrity Protection - Apple Support](https://support.apple.com/guide/security/system-integrity-protection-secb7ea06b49/web)\n- [OSX Serial Generator - GitHub](https://github.com/sickcodes/osx-serial-generator)\n- [macOS Attack Matrix - Medium](https://r1971d3.medium.com/macos-attack-matrix-gathering-system-information-using-ioplatformexpertdevice-part-2-8162f3b83415)\n- [OS Fingerprinting Research - ResearchGate](https://www.researchgate.net/publication/317930445_OS_Fingerprinting_New_Techniques_and_a_Study_of_Information_Gain_and_Obfuscation)\n- [Apple Device Fingerprinting Rules - AdGuard](https://adguard.com/en/blog/apple-device-fingerprinting-rules.html)\n- [Terminal Serial Number Access - Ask Different](https://apple.stackexchange.com/questions/40243/how-can-i-find-the-serial-number-on-a-mac-programmatically-from-the-terminal)\n- [macOS Security Tools - Macworld](https://www.macworld.com/article/228879/first-look-little-flocker-and-blockblock-help-monitor-your-macs-security.html)\n- [Apple Silicon Security Settings - Apple Support](https://support.apple.com/guide/mac-help/change-security-settings-startup-disk-a-mac-mchl768f7291/mac)\n\n### License\nMIT © 2025 Gaston Morixe\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgastonmorixe%2Fmacos-serial-number-leak","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgastonmorixe%2Fmacos-serial-number-leak","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgastonmorixe%2Fmacos-serial-number-leak/lists"}