Nasty macOS bug could give hackers the keys to the kingdom
The vulnerability affects all macOS releases, past and present
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
A new vulnerability inmacOS’ Finder file manager reportedly makes it possible for attackers to run arbitrary commands onMacsacross all versions of theoperating systemincluding the latest release,Big Sur.
BleepingComputerreports that the bug, reported bycybersecurityresearcher Park Minchan, exists because of how macOS handles internet location (inetloc) shortcuts.
“A vulnerability in macOS Finder allows files whose extension is inetloc to execute arbitrary commands, these files can be embedded inside emails which if the user clicks on them will execute the commands embedded inside them without providing a prompt or warning to the user," reads anadvisory on the issuefrom SSD Secure Disclosure.
We’re looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won’t take more than 60 seconds of your time, and we’d hugely appreciate if you’d share your experiences with us.
Click here to start the survey in a new window«
Although Minchan hasn’t provided details on how attackers might abuse the vulnerability,BleepingComputersuggests one way to exploit it is by delivering malicious email attachments that could perhaps launch a bundled or remote payload.
Addressed improperly
The SSD Secure Disclosure advisory suggests thatApplehas silently fixed the issue without assigning a CVE identification number. However, a followup by Minchan reveals that Apple’s patch addresses the flaw only partially, and it can still be exploited with slight variations to the attack methodology.
“We have notified Apple that FiLe:// (just mangling the value) doesn’t appear to be blocked, but have not received any response from them since the report has been made. As far as we know, at the moment, the vulnerability has not been patched,” claims the SSD Secure Disclosure advisory.
BleepingComputerwent one step ahead and tested a proof-of-concept exploit shared by Minchan, which worked just as the researcher had observed in his disclosure.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
ViaBleepingComputer
With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’sTechRadar Pro’sexpert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.
Washington state court systems taken offline following cyberattack
Is it still worth using Proton VPN Free?
Top 3 things you have to try with the new ChatGPT search
