Microsoft Threat Intelligence uncovered a macOS vulnerability that could potentially allow an attacker to bypass the operating system’s Transparency, Consent, and Control (TCC) technology and gain unauthorized access to a user’s protected data.
The vulnerability, which we refer to as “HM Surf”, involves removing the TCC protection for the Safari browser directory and modifying a configuration file in the said directory to gain access to the user’s data, including browsed pages, the device’s camera, microphone, and location, without the user’s consent. Apple released a fix for this vulnerability, now identified as CVE-2024-44133, as part of security updates for macOS Sequoia, released on September 16, 2024.
Read more…
Source: Microsoft
Related:
- Google Warns of Growing Android Attack Vector: Backdoored SDKs and Pre-Installed Apps
April 1, 2019
Google is reporting an uptick in efforts by bad actors to plant potentially harmful applications (PHAs) on Android devices via pre-installed apps and by bundling them with system updates delivered over the air. The technique is especially troubling, Google said, because PHAs are often malicious and users have no control over what comes pre-installed on their ...
- Critical Rockwell Automation Bug in Drive Component Puts IIoT Plants at Risk
March 29, 2019
A critical Rockwell Automation flaw could be exploited to manipulate an industrial drive’s physical process and or even stop it. A critical denial-of-service (DoS) vulnerability has been found in a Rockwell Automation industrial drive, which is a logic-controlled mechanical component used in industrial systems to manage industrial motors. The vulnerability was identified in Rockwell Automation’s PowerFlex 525 ...
- The latest dark web cyber-criminal trend: Selling children’s personal data
March 27, 2019
Imagine you’re a teenager, applying for credit to buy your first car or maybe a loan to go to university. You don’t remember taking out a credit card when you were six years old, but the bank is adamant, and now you have a poor credit rating and in their eyes, you’re persona non grata. ...
- Threat Landscape for Industrial Automation Systems in H2 2018
March 27, 2019
All statistical data used in this report was collected using the Kaspersky Security Network (KSN), a distributed antivirus network. The data was received from those KSN users who gave their consent to have data anonymously transferred from their computers. We do not identify the specific companies/organizations sending statistics to KSN, due to the product limitations and regulatory ...
- Malware Payloads Hide in Images: Steganography Gets a Reboot
March 25, 2019
Low-key but effective, steganography is an old-school trick of hiding code within a normal-looking image, where many cybersecurity pros may not think to look. One of the challenges of cybersecurity is that overfocusing on one threat trend means that another one can sneak up on you. This is especially problematic as our networks and the attack ...
- Medtronic’s Implantable Defibrillators Vulnerable to Life-Threatening Hacks
March 22, 2019
The U.S. Department of Homeland Security Thursday issued an advisory warning people of severe vulnerabilities in over a dozen heart defibrillators that could allow attackers to fully hijack them remotely, potentially putting lives of millions of patients at risk. Cardioverter Defibrillator is a small surgically implanted device (in patients’ chests) that gives a patient’s heart an ...