Microsoft Researchers Detail macOS Vulnerability That Could Let Attackers Gain User Data

[Pelican Press 0]

This is the hidden content, please

• Sign In
• or
• Sign Up

Researchers Detail macOS Vulnerability That Could Let Attackers Gain User Data

This is the hidden content, please

• Sign In
• or
• Sign Up

has detailed a vulnerability that existed in macOS which could allow an attacker to bypass its inbuilt technology controls and gain access to users’ protected data. Dubbed “powerdir,” the issue impacts the system called Transparency, Consent, and Control (TCC) that has been available since 2012 to help users configure privacy settings of their apps. It could let attackers ******* an existing app installed on a Mac computer or install their own app and start accessing hardware including microphone and camera to gain user data.

As

This is the hidden content, please

• Sign In
• or
• Sign Up

on a blog post, the macOS vulnerability could be exploited by bypassing TCC to target users’ sensitive data. Apple notably fixed the flaw in the macOS Monterey 12.1 update that was released last month. It was also

This is the hidden content, please

• Sign In
• or
• Sign Up

through the macOS Big Sur 11.6.2 release for older hardware. However, devices that are using an older macOS version are still vulnerable.

Apple is using TCC to help users configure privacy settings such as access to the device’s camera, microphone, and location as well as services including calendar and iCloud account. The technology is

This is the hidden content, please

• Sign In
• or
• Sign Up

through the Security & Privacy section in System Preferences.

On top of TCC, Apple uses a feature that is aimed to prevent systems from unauthorised code ********** and enforced a policy that restricts access to TCC to only apps with full disk access. An attacker can, though, change a target user’s home directory and plant a fake TCC database to gain the consent history of app requests,

This is the hidden content, please

• Sign In
• or
• Sign Up

security researcher Jonathan Bar Or said in the blog post.

“If exploited on unpatched systems, this vulnerability could allow a malicious actor to potentially orchestrate an ******* based on the user’s protected personal data,” the researcher said.

This is the hidden content, please

• Sign In
• or
• Sign Up

’s researchers also developed a proof-of-concept to demonstrate how the vulnerability could be exploited by changing the privacy settings on any particular app.

Apple has

This is the hidden content, please

• Sign In
• or
• Sign Up

the efforts made by the

This is the hidden content, please

• Sign In
• or
• Sign Up

team in its security document. The vulnerability is traced as

This is the hidden content, please

• Sign In
• or
• Sign Up

.

---

Affiliate links may be automatically generated – see our ethics statement for details.

This is the hidden content, please

• Sign In
• or
• Sign Up

macos vulnerability tcc powerdir

This is the hidden content, please

• Sign In
• or
• Sign Up

researchers report apple fix update macos vulnerability,powerdir,

This is the hidden content, please

• Sign In
• or
• Sign Up

,apple,macos
#

This is the hidden content, please

• Sign In
• or
• Sign Up

#Researchers #Detail #macOS #Vulnerability #Attackers #Gain #User #Data

This is the hidden content, please

• Sign In
• or
• Sign Up