Microsoft claims it found a major macOS security bug that could put all your data at risk

2 weeks ago

(Image credit: Shutterstock) (Image credit: Shutterstock)

Microsoft information researchers person uncovered a vulnerability successful nan macOS operating system that could let threat actors to summation entree to delicate information stored connected nan device.

The institution elaborate its findings successful a blog post, which claimed nan flaw bypasses nan operating system’s Transparency, Consent, and Control (TCC) technology, and it was dubbed “HM Surf”.

The bug is now tracked arsenic CVE-2024-44133. It has a severity people of 5.5 (medium), and was fixed successful mid-September 2024.

What astir Chrome, aliases Firefox?

Microsoft explained that nan vulnerability removes TCC protection for nan Safari browser directory, and allows for nan modification of a configuration record successful that directory. As a result, nan malicious character gains entree to personification data, specified arsenic browsed pages, nan camera, microphone, location, and much - each without personification consent.

While nan bug being patched is decidedly bully news, location is simply a caveat. As explained successful nan article, only Safari uses nan caller protections afforded by nan TCC, astatine nan moment. That intends different browsers, specified arsenic Chrome, aliases Firefox, “do not person nan aforesaid backstage entitlements arsenic Apple applications,” truthful they can’t activity astir nan TCC checks. In different words, erstwhile a personification approves TCC checks, nan app is nan 1 maintaining entree to nan privateness database.

“Microsoft is presently collaborating pinch different awesome browser vendors to analyse nan benefits of hardening section configuration files,” nan institution explained.

Apple users are encouraged to use nan information update arsenic soon arsenic possible, since Microsoft claims to person recovered a imaginable lawsuit of in-the-wild abuse:

Sign up to nan TechRadar Pro newsletter to get each nan apical news, opinion, features and guidance your business needs to succeed!

“Behavior monitoring protections successful Microsoft Defender for Endpoint has detected activity associated pinch Adload, a prevalent macOS threat family, perchance exploiting this vulnerability,” it concluded.

More from TechRadar Pro

Google hails move to Rust for immense driblet successful representation vulnerabilities
Here's a database of nan best firewalls today
These are nan best endpoint protection tools correct now

Sead is simply a seasoned freelance journalist based successful Sarajevo, Bosnia and Herzegovina. He writes astir IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, information breaches, laws and regulations). In his career, spanning much than a decade, he’s written for galore media outlets, including Al Jazeera Balkans. He’s besides held respective modules connected contented penning for Represent Communications.

Source Technology