Microsoft details macOS vulnerability that allowed protected data access

AppleInsider

Microsoft has released details of the "Powerdir" vulnerability that allowed an attacker to access protected data on a Mac, prior to the December macOS Monterey patches.

Published on Monday, the blog by the Microsoft 365 Defender Research Team explains the details behind the Powerdir vulnerability. The discovery could allow attackers to "bypass the operating system's Transparency, Consent and Control (TCC) technology" allowing access to protected user data.

TCC was introduced by Apple to macOS Mountain Lion in April 2012, and is designed to help users configure privacy settings for apps. For example, it would enable or deny access to onboard cameras and microphones, a user's calendar, or an iCloud account.

As a means to protect TCC, Apple also included a feature to prevent unauthorized code execution, as well as adding a policy restricting access to TCC only to apps with full disk access.

In its lengthy explanation, Microsoft says it managed to work out how to change a user's home directory to plant a fake TCC database. An attacker could then use the database change to perform an attack on elements that would otherwise be protected by TCC normally.

This could involve an attacker taking over an app already installed on the Mac, or installing one of their own, and in turn accessing the user's data. It could also feasibly be used to gain access to a connected camera or mic, to actively spy on the user.

Microsoft responsibly disclosed the discovery with Apple, which led to the creation of a fix. Apple patched the exploit as part of its update to macOS 12.1 on December 13.

It is unclear exactly how severe the vulnerability is to exploitation, but a reading suggests the risk is reasonably low for most users. Changing the home directory would normally require local access, or pairing with some form of mechanism that grants a level of control for it to work remotely, and it is prevented for anyone who regularly updates their Mac anyway.

How to protect yourself

As macOS Monterey 12.1 is protected from the issue, the simple answer is to update macOS to the latest version. Apple also released an update at the same time for macOS Big Sur 11.6.2, so older Macs that don't support Monterey can be protected from the problem.

It is generally good practice to update all Macs to the latest supported operating system update, as soon as possible after its release.

Read on AppleInsider

rob53

And we’re congratulating the largest vendor of malware for what reason? 

aatb

rob53 said:

And we’re congratulating the largest vendor of malware for what reason? 

Following the notification process correctly and helping MacOS be more secure?  

rob53

aatb said:

rob53 said:

And we’re congratulating the largest vendor of malware for what reason? 

Following the notification process correctly and helping MacOS be more secure?  

Vulnerability had to do with software Microsoft didn’t like so they tried to work around it. When they discovered how to attack it, one employee had the ethics to tell Apple about it. Microsoft doesn’t do anything that isn’t of value to them. They spent decades not patching their software because they felt there wasn’t an alternative. Now they have a good income stream from Mac users so they’re trying to keep it.

5 posts??

cpsro

rob53 said:

And we’re congratulating the largest vendor of malware for what reason? 

For educating every malware maker about how to target macOS. It wasn't enough that the vulnerability was patched.

wood1208

Microsoft must keep it's mouth shut when the OS vulnerability is concern. Individuals and businesses have lost so much in money,time,productivity and frustration because of Windows vulnerability exploited by many people creating and installing viruses for decades. Microsoft helped created Windows anti-virus software industry. Another burden on Windows customers to buy and keep paying upgrading.

macxpress

I don't mind Microsoft or Google security researchers finding holes in any OS. At least they're found and can be patched. Not sure why this is such an issue with people. I don't believe their sole purpose is to just shit all over Apple because they found a hole in macOS or iOS. 

applguy

Headlines you’ll never see…
Microsoft details Windows vulnerability that allowed…

danvm

wood1208 said:

Microsoft must keep it's mouth shut when the OS vulnerability is concern. Individuals and businesses have lost so much in money,time,productivity and frustration because of Windows vulnerability exploited by many people creating and installing viruses for decades. Microsoft helped created Windows anti-virus software industry. Another burden on Windows customers to buy and keep paying upgrading.

Based in my experience and from what I have seen, Windows 10 have been very secure, and the issues with malware are lower compared to previous versions of Windows.  At the same time, I find interesting how Craig Federighi said that "he level of Mac malware is not acceptable".  

The level of Mac malware is not acceptable, says Apple’s Craig Federighi at Epic trial - The Verge

And when you see the whole picture, macOS above 10% in worldwide usage.  Can you imagine what would happen if it reach the 90% of Windows?  I think it would be at the same level of Windows, maybe worse.  Who knows. 

danvm

rob53 said:

aatb said:

rob53 said:

And we’re congratulating the largest vendor of malware for what reason? 

Following the notification process correctly and helping MacOS be more secure?  

Vulnerability had to do with software Microsoft didn’t like so they tried to work around it. When they discovered how to attack it, one employee had the ethics to tell Apple about it. Microsoft doesn’t do anything that isn’t of value to them. They spent decades not patching their software because they felt there wasn’t an alternative. Now they have a good income stream from Mac users so they’re trying to keep it.

5 posts??

Did you read the security blog?  Because I didn't see anything about a MS software they didn't like.  And it wasn't one employee that told Apple, but the MSVR,
https://www.microsoft.com/en-us/msrc/msvr?rtc=1
https://www.microsoft.com/en-us/msrc/cvd?rtc=1

And I agree, Microsoft doesn’t do anything that isn’t of value to them.  Considering many of their customer use macOS, it will benefit to secure and protect them, which at the end helps to improve the security in business and enterprises that use the MS ecosystem.  It also help to improve Microsoft Defender for Endpoint, that has a macOS client.  

BTW, I have +1200 posts.  Is that good enough?

macxpress

rob53 said:

aatb said:

rob53 said:

And we’re congratulating the largest vendor of malware for what reason? 

Following the notification process correctly and helping MacOS be more secure?  

Vulnerability had to do with software Microsoft didn’t like so they tried to work around it. When they discovered how to attack it, one employee had the ethics to tell Apple about it. Microsoft doesn’t do anything that isn’t of value to them. They spent decades not patching their software because they felt there wasn’t an alternative. Now they have a good income stream from Mac users so they’re trying to keep it.

5 posts??

Why does it matter how many posts someone has? Just because you didn't like what they had to say and they "only" have 5 posts doesn't mean their post should be invalidated. Quite frankly I applaud other companies finding security issues with any OS, even if its from your competitor of some sort. It only helps everyone in the end. Like I said before, it's not about Microsoft just trying to shit all over Apple because a security risk was found. If it weren't for this, Apple may not have known, or known after it was too late. It's not the best approach to have this me vs them attitude with everything. 

mplsp

rob53 said:

aatb said:

rob53 said:

And we’re congratulating the largest vendor of malware for what reason? 

Following the notification process correctly and helping MacOS be more secure?  

Vulnerability had to do with software Microsoft didn’t like so they tried to work around it. When they discovered how to attack it, one employee had the ethics to tell Apple about it. Microsoft doesn’t do anything that isn’t of value to them. They spent decades not patching their software because they felt there wasn’t an alternative. Now they have a good income stream from Mac users so they’re trying to keep it.

5 posts??

They found a vulnerability, informed Apple and gave them a chance to patch it then released the details, letting other researchers learn from it. This is pretty standard protocol. I don’t like Microsoft, either, but they did exactly what they should have here.

What’s wrong with having 5 posts?