Researchers have uncovered significant vulnerabilities in macOS privacy protection. According to researchers Csaba Fitzl and Wojciech Regula with Offensive Security and SecuRing respectively, applications that are allowed to run on Apple’s operating system can exceed the permissions granted to them by the user. This allows for potential privacy attacks, such as stealing address book information, taking screenshots, and gaining access to system files. The two researchers detailed their findings at the annual Black Hat USA cybersecurity conference.
Fitzl and Wojciech found more than six vulnerabilities and insecure configurations that allowed them to bypass the core mechanism set in place to protect user privacy, known as Apple’s Transparency, Consent, and Control framework. The researchers were able to leverage malicious plug-ins and process injection into third-party applications to attack the TCC framework. The researchers were able to gain full permission on the system by leveraging the vulnerabilities. The researchers reported their findings to Apple and many of the flaws have since been fixed. However, the pair stated that the weaknesses do not just apply to Apple but rather represent a larger issue that third-party software makers need to address.
Read More: Researchers Find Significant Vulnerabilities in macOS Privacy Protections
