At the end of last year, Apple fixed one of the most serious flaws in its system, which involves the Safari browser and the iCloud tool. And it is that through a vulnerability in this browser, it was possible that cybercriminals could access our account data, microphone, or even webcam.
Through their bounty program for finding security issues, Apple rewarded the independent researcher who discovered the flaw with $100,500.
A vulnerability that bypasses all macOS protections
As reported by the Wired medium, macOS has a good number of protections in its system to deal with this type of attack. One of them is Gatekeeper, which confirms the validation of the software running on the computer. However, the vulnerability found can bypass these protections. taking advantage of some of the features that Safari and iCloud offer.
Ryan Pickren, the independent researcher who discovered this flaw, has posted on his website how it was possible to access the victim’s computer through iCloud and Safari. Pickren noticed that Apple uses an application called ShareBear to proceed with the transfer of files in iCloud. The researcher found a way to take control of this application, thus allowing other users to share malicious files.
The close relationship between all these apps facilitated this process, since a cybercriminal could silently exchange the shared file for one that contained malware. Once the malicious file is inserted, the hacker can take full control of the victim through Safari, obtaining private account information, and taking advantage of permissions granted to web pages to activate the victim’s camera or microphone. Here is what Pickren has to say about this bug:
“The attacker is basically drilling a hole in the browser. If you’re logged into Twitter.com in a tab, I could go in there and do everything you can do from Twitter. But it has nothing to do with security or servers.” of Twitter; I as an attacker am only assuming the role that you have in your browser”.
It is not the first time that this researcher has discovered a vulnerability in Safari, since he has also found other ways to activate the webcam through the browser itself. In the case we have discussed, Pickren discovered the vulnerability in mid-July, and Apple rewarded him with it with $ 100,500 once confirmed and resolved. This is a significant amount, and reflects the severity of the security breach.