Microsoft Office, Teams Vulnerabilities Enable Hackers to Access Camera and Microphone on macOS: Report

[Pelican Press 0]

This is the hidden content, please

• Sign In
• or
• Sign Up

This is the hidden content, please

• Sign In
• or
• Sign Up

Office, Teams Vulnerabilities Enable Hackers to Access Camera and Microphone on macOS: Report

A cybersecurity group has discovered multiple vulnerabilities in apps developed by

This is the hidden content, please

• Sign In
• or
• Sign Up

for macOS that allowed hackers to target users. The security flaws affect apps such as

This is the hidden content, please

• Sign In
• or
• Sign Up

Office,

This is the hidden content, please

• Sign In
• or
• Sign Up

, Teams, OneNote and other apps from the Redmond firm, and hackers were able to access a user’s camera and microphone by misusing Apple’s permission framework on its desktop operating system.. While

This is the hidden content, please

• Sign In
• or
• Sign Up

has issued fixes for two of its applications on macOS, its other apps are still vulnerable to attackers.

This is the hidden content, please

• Sign In
• or
• Sign Up

App Vulnerabilities Let Hackers Access Camera, Microphone Without Permissions

Cybersecurity group Cisco Talos revealed details of eight vulnerabilities spotted in

This is the hidden content, please

• Sign In
• or
• Sign Up

’s apps for macOS in a

This is the hidden content, please

• Sign In
• or
• Sign Up

. These flaws allowed hackers to inject specially crafted malicious libraries into six

This is the hidden content, please

• Sign In
• or
• Sign Up

apps —

This is the hidden content, please

• Sign In
• or
• Sign Up

, Teams, PowerPoint, Excel, Word, OneNote — and bypass Apple’s permission model on macOS.

data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///ywAAAAAAQABAAACAUwAOw==

How hackers can inject malicious libraries into legitimate apps on macOS
Photo Credit: Cisco Talos

 

In order to gain access to a user’s microphone and camera, malicious software would need to be granted explicit user consent for the relevant permissions, in accordance with Apple’s Transparency, Consent and Control (TCC) framework on macOS. However. some malicious programs can use a process called library injection (or dylib injection on macOS) to gain access to permissions that were granted to other apps.

As a result, macOS users who had

This is the hidden content, please

• Sign In
• or
• Sign Up

’s apps installed on their computer could be vulnerable to hacking, according to Cisco Talos. The flaws allowed hackers to record audio by injecting libraries into the aforementioned apps.

This is the hidden content, please

• Sign In
• or
• Sign Up

Excel is the only app in the list that doesn’t have access to the microphone, while apps such as

This is the hidden content, please

• Sign In
• or
• Sign Up

Teams can also access the device’s camera.

This is the hidden content, please

• Sign In
• or
• Sign Up

Patches Two Affected Apps, Other Apps Remain Vulnerable

 The cybersecurity group says that it reported the security vulnerabilities to

This is the hidden content, please

• Sign In
• or
• Sign Up

, and the firm has since updated two of the affected apps with fixes for the flaws. Users who are running the latest versions of

This is the hidden content, please

• Sign In
• or
• Sign Up

Teams and OneNote should not be impacted, but the company’s

This is the hidden content, please

• Sign In
• or
• Sign Up

and Office apps are currently affected by the security flaw.

According to Cisco Talos,

This is the hidden content, please

• Sign In
• or
• Sign Up

should not have disabled library validation, as it exposes users to unnecessary risks by bypassing hardened runtime safeguards put in place by Apple on the OS, designed to protect users via TCC and its permission model.

Apple could increase security on macOS by prompting users when a third-party plugin is being loaded into apps, as these apps might have already been granted permissions. This could warn users that these external plugins can access the same permissions granted to the original app. 

This is the hidden content, please

• Sign In
• or
• Sign Up

#

This is the hidden content, please

• Sign In
• or
• Sign Up

#Office #Teams #Vulnerabilities #Enable #Hackers #Access #Camera #Microphone #macOS #Report

This is the hidden content, please

• Sign In
• or
• Sign Up

This is the hidden content, please

• Sign In
• or
• Sign Up