• Home
  • About
  • Contact us
Tech News, Magazine & Review WordPress Theme 2017
  • Computing
  • Entertainment
  • Gaming
  • Mobile
  • Science
  • Security
  • Services
  • Software
  • Space
No Result
View All Result
  • Computing
  • Entertainment
  • Gaming
  • Mobile
  • Science
  • Security
  • Services
  • Software
  • Space
Technovanguard — Be at the forefront of technology news
No Result
View All Result

Microsoft says Powerdir vulnerability in macOS could have given attackers access to user data

Justin Rowell by Justin Rowell
29.09.2022
Home Software

The Microsoft 365 Defender Research Team has revealed that it discovered a security vulnerability in macOS Monterey. This is the 2nd time the Redmond company discovered a security issue in macOS, after the Shrootless vulnerability, that came to light in October 2021.

macos TCC

What is the Powerdir vulnerability?

It is a security loophole that impacts a component in macOS called Transparency, Consent, and Control (TCC). This technology prevent apps from accessing the user’s personal data like the iCloud, Calendar, as well as hardware such as the camera, microphone and location.

Apple had a security feature in place to restrict apps from accessing TCC, this policy only allowed apps with full disk access to make changes. Microsoft’s researchers discovered that changing the home directory of a user, and spoofing a fake TCC database in its place, was enough to allow apps to bypass TCC’s protection and compromise the data it should have protected. This exploit could have potentially be used for targeted attacks, e.g. a hacker could install replace an app with a malicious one to record private conversations, take screenshots of the user’s screen, aka spy on the user.

Microsoft discovers Powerdir vulnerability in macOS

The above screenshot, from Microsoft’s team, shows a proof-of-concept exploit to highlight how the Powerdir vulnerability was successful in gaining access to the user data. This is not the first time TCC has been found to be vulnerable, writes, Jonathan Bar Or, Senior Security Researcher at Microsoft. He notes that three such TCC related issues, namely Time Machine mounts (CVE-2020-9771), Environment variable poisoning (CVE-2020-9934), and Bundle conclusion issue (CVE-2021-30713), were patched by Apple since 2020. The report goes on to state that Microsoft was aware of other similar exploits, but these had been fixed by Apple, but when testing a fix for one of these, the researchers stumbled upon a new bug, Powerdir. Interestingly, the researchers had to update their proof-of-concept exploit, after a macOS update prevented the initial version from working.

Having confirmed that the bug in TCC could be exploited, Microsoft’s Security Researchers shared their findings with Apple in July 2021, via Coordinated Vulnerability Disclosure (CVD), to allow the Cupertino company to patch the issue. Bleeping Computer notes that Microsoft collaborated with NETGEAR last year, to resolve critical bugs in the firmware of some router models, that hackers could have used to breach enterprise networks. It is good to see tech giants working together to protect users, but we have also seen independent security experts contribute to the ecosystem for the same cause.

Powerdir vulnerability has been patched in macOS 12.1 Update

Apple released the macOS 12.1 Update in December 2021, and this software update includes fixes for several security issues that were reported by researchers, and it includes a patch for the Powerdir vulnerability. The issue has been assigned the tag CVE-202-30970. Apple’s Security Advisory mentions the Powerdir vulnerability’s impact as” A malicious application may be able to bypass Privacy preferences.” The description for the patch says that a logic issue was addressed with improved state management.

The vulnerability has also been patched in macOS Big Sur 11.6.2.

If you have not updated your macOS, you should install the patch as soon as possible.

Thank you for being a Ghacks reader. The post Microsoft says Powerdir vulnerability in macOS could have given attackers access to user data appeared first on gHacks Technology News.


Next Post
Streamer beats Celeste ‘driving’ through it with steering wheel

Streamer beats Celeste ‘driving’ through it with steering wheel

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Recommended.

NFL 2021: How to watch Bills vs. Buccaneers, Bears vs. Packers and the rest of Week 14 without cable

NFL 2021: How to watch Bills vs. Buccaneers, Bears vs. Packers and the rest of Week 14 without cable

29.09.2022
NVIDIA DLSS/RTX to Be Added in 10 New Games, NVIDIA Reflex in 7

NVIDIA DLSS/RTX to Be Added in 10 New Games, NVIDIA Reflex in 7

29.09.2022

Trending.

Travel Business and Content Marketing: A Match Made in Heaven

Travel Business and Content Marketing: A Match Made in Heaven

07.02.2023
Netflix’s vampire movie Day Shift adds real bite to a classic action throwback

Netflix’s vampire movie Day Shift adds real bite to a classic action throwback

06.01.2023
Staying Ahead of the Game: The Top 10 Most Popular Websites for IT and Modern Technology

Staying Ahead of the Game: The Top 10 Most Popular Websites for IT and Modern Technology

30.01.2023
The Role of Technology in Transforming Healthcare Advertising

The Role of Technology in Transforming Healthcare Advertising

03.01.2023
How did Earth go From Molten Hellscape to Habitable Planet?

How did Earth go From Molten Hellscape to Habitable Planet?

29.09.2022
Technovanguard — Be at the forefront of technology news

Technovanguard - The latest news from the world of IT and modern technologies.

Categories

  • Computing
  • Entertainment
  • Gaming
  • Internet
  • Mobile
  • Science
  • Security
  • Services
  • Software
  • Space
  • Без рубрики

Tags

best bitcoin casino best bitcoin gambling site best crypto casino bitcoin gambling site btc casino FEATUREDNEWS linkedin connection message linkedin connection request template linkedin connect message examples linkedin networking message template linkedin sales message top bitcoin casinos

Recent News

Talents on AI: Kyiv to Host Three-Day Hackathon Connecting Developers and Sponsors in May 2023

Talents on AI: Kyiv to Host Three-Day Hackathon Connecting Developers and Sponsors in May 2023

07.03.2023
Ukrainian NFT Collection Honors Heroes and Raises Funds for Naval Combat Drones

Ukrainian NFT Collection Honors Heroes and Raises Funds for Naval Combat Drones

17.02.2023
  • Home
  • About
  • Contact us

© 2021 technovanguard.com. Submit news release

No Result
View All Result
  • Computing
  • Entertainment
  • Gaming
  • Mobile
  • Science
  • Security
  • Services
  • Software
  • Space

© 2021 technovanguard.com. Submit news release