Mac users advised to update software urgently after Microsoft finds macOS bug that could allow hackers to access private data
The issue has been dubbed as "powerdir" and it impacts the TCC system.
Apple macOS: A vulnerability in Apple’s macOS has been detailed by researchers at Microsoft. According to the researchers, this vulnerability could have given attackers the ability to bypass the technology controls built into the Mac computer and access the protected data of the users. The issue has been dubbed as “powerdir” and it impacts the TCC system – standing for Transparency, Consent and Control system. The TCC system allows users to configure the privacy settings of their apps and has been in place since 2012.
As per the details of the vulnerability, the attackers could hijack an existing app that is installed on the Mac or even install their own app into the Apple computer, with them then being able to access hardware like camera as well as microphone to gather user data. While the vulnerability has been fixed by the iPhone maker in the macOS Monterey 12.1 version update sent out last month and through the macOS Big Sur 11.6.2 update that was released for older devices, the issue still persists for devices that run on older versions of macOS.
Microsoft said, “We encourage macOS users to apply these security updates as soon as possible.”
TCC is used by the tech giant to let users set their privacy controls, like whether they wish to provide access to the microphone, camera, or location, and even for configuring settings like iCloud account and calendar. It can be accessed in System Preferences, under the section on Security & Privacy.
Apple also uses a feature on top of TCC which aims to prevent systems from undergoing an unauthorised code execution, and a policy restricts TCC access to only those apps having a full disc access. However, an attacker can still change the home directory of the target user and gain the consent history of app requests by planting a fake TCC database, Microsoft researchers said. The researchers also created a proof-of-concept in order to be able to demonstrate how this could be exploited.
The efforts of the Microsoft team to detail the vulnerability have been acknowledged by Apple.
