Hackers Exploit The Powerdir Flaw For Access To MacOS Data

Share post:

The Microsoft 365 Defender Research Team has discovered a flaw known as powedir.

The bug, a macOS vulnerability, allows threat actors to gain access to the user’s protected data.

Attackers can do this by bypassing Transparency, Consent, and Control (TCC) technology. TCC was created to block apps from accessing sensitive user data.

The technology achieves this goal by allowing macOS users to configure privacy settings for the apps installed on their systems and devices connected to their Macs.

Apple has restricted TCC access to only apps with full disk access. Apple has also set up features to automatically block unauthorized code execution.

However, Microsoft researchers have shown that attackers can create a second, specially crafted TCC database that allows them to access protected user information.

“If exploited on unpatched systems, this vulnerability could allow a malicious actor to potentially orchestrate an attack based on the user’s protected personal data,” said Jonathan Bar Or, a principal security researcher at Microsoft.

For more information, read the original story in BleepingComputer.

SUBSCRIBE NOW

Related articles

Cyber Security Today, May 20, 2024 -Ransomware gang claims it hit a Canadian internet provider

A ransomware gang claims it hit a Canadian internet provider. Welcome to Cyber Security Today. It's Monday May 20th,...

Cyber Security Today, Week in Review for week ending Friday May 17, 2024

Welcome to Cyber Security Today. This is the Week in Review for the week ending Friday, May 17th,...

Cyber Security Today, May 17, 2024 – Malware hiding in Apache Tomcat servers

Malware hiding in Apache Tomcat servers, new backdoors found, and more Welcome to Cyber Security Today. It's Friday, May...

MIT students exploit blockchain vulnerability to steal 25 million dollars

Two MIT students have been implicated in a highly sophisticated cryptocurrency heist, where they reportedly exploited a vulnerability...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways