• Nasty macOS bug could give hackers the keys to the kingdom

    From TechnologyDaily@1337:1/100 to All on Wed Sep 22 14:15:04 2021
    Nasty macOS bug could give hackers the keys to the kingdom

    Date:
    Wed, 22 Sep 2021 13:02:19 +0000

    Description:
    Apple's silent fix to macOS file manager vulnerability doesnt solve the issue completely, according to researchers.

    FULL STORY ======================================================================

    A new vulnerability in macOS Finder file manager reportedly makes it
    possible for attackers to run arbitrary commands on Macs across all versions of the operating system including the latest release, Big Sur .

    BleepingComputer reports that the bug, reported by cybersecurity researcher Park Minchan, exists because of how macOS handles internet location (inetloc) shortcuts.

    A vulnerability in macOS Finder allows files whose extension is inetloc to execute arbitrary commands, these files can be embedded inside emails which
    if the user clicks on them will execute the commands embedded inside them without providing a prompt or warning to the user," reads an advisory on the issue from SSD Secure Disclosure. TechRadar needs you!

    We're looking at how our readers use VPNs with streaming sites like Netflix
    so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and we'd hugely appreciate if you'd share your experiences with us.

    Click here to start the survey in a new window << Protect your devices
    with these best antivirus software Take a look at these best antivirus software for macOS These are the best malware removal software on the market

    Although Minchan hasnt provided details on how attackers might abuse the vulnerability, BleepingComputer suggests one way to exploit it is by delivering malicious email attachments that could perhaps launch a bundled or remote payload. Addressed improperly

    The SSD Secure Disclosure advisory suggests that Apple has silently fixed the issue without assigning a CVE identification number. However, a followup by Minchan reveals that Apple's patch addresses the flaw only partially, and it can still be exploited with slight variations to the attack methodology.

    We have notified Apple that FiLe:// (just mangling the value) doesnt appear
    to be blocked, but have not received any response from them since the report has been made. As far as we know, at the moment, the vulnerability has not been patched, claims the SSD Secure Disclosure advisory.

    BleepingComputer went one step ahead and tested a proof-of-concept exploit shared by Minchan, which worked just as the researcher had observed in his disclosure. Weve also compiled a list of the best ransomware protection tools

    Via BleepingComputer



    ======================================================================
    Link to news story: https://www.techradar.com/news/nasty-macos-bug-could-give-hackers-the-keys-to- the-kingdom/


    --- Mystic BBS v1.12 A47 (Linux/64)
    * Origin: tqwNet Technology News (1337:1/100)