Skip to main content

Security researcher claims macOS Mojave privacy bug on launch day

A security researcher has claimed a new vulnerability in the latest version of macOS — just hours before the software is due to be released.

Patrick Wardle, chief researcher officer at Digita Security, tweeted a video Monday of an apparent privacy feature bypass that’s designed to prevent apps from improperly accessing a user’s personal data.

For years, Macs have forced apps to ask for permission before accessing your contacts and calendar after some iOS apps were caught uploading private data. Apple said at its annual developer conference this year that it would expand the feature to include apps asking for permission to access the camera, microphone, email and backups.

Wardle told TechCrunch that his findings are “not a universal bypass” of the feature, but that the bug could allow a malicious app to grab certain protected data, such as a user’s contacts, when a user is logged in.

The video shows the operating system initially rejecting access to his stored contacts, but later copying his entire address book to the desktop after running an unprivileged script simulating a malicious app.

Wardle isn’t releasing specifics of the bug yet, he said, because he doesn’t want to put users at risk, but dropped the video out of frustration at the company’s lack of bug bounty, which he said disincentives security researchers from reporting bugs to the company.

“Other operating system vendors have acknowledged that any software is going to have vulnerabilities,” but that Apple is “sticking its head in the sand.”

Apple was one of the last major companies to roll out a bug bounty program — giving security researchers money in exchange for responsibly disclosed vulnerabilities. Apple began offering cash bounties of up to $200,000 for the most severe iOS bugs. But the company has neglected to port the program over to macOS, for reasons unknown.

“Unfortunately until there’s a reason for Apple to change its approach to security, it’s not going to,” he said. “Generally, companies don’t change something until they realize it’s broken.”

We reached out to Apple for comment and will update if we hear back.

It’s the second time Wardle released details of a serious vulnerability in macOS on launch day — the most recent case was almost exactly a year ago at the launch of macOS High Sierra.

Wardle is expected to talk more of the technical details of the Mojave bug at the Objective-by-the-Sea conference in November, he said.

Apple will release macOS Mojave later on Monday.

The best security and privacy features in iOS 12 and macOS Mojave



from Apple – TechCrunch https://ift.tt/2OS1kDy
Labels:

Comments

Post a Comment

Popular posts from this blog

Axeleo Capital raises $51 million fund

Axeleo Capital has raised a $51 million fund (€45 million). Axeleo first started with an accelerator focused on enterprise startups. The firm is now all grown up with an acceleration program and a full-fledged VC fund. The accelerator is now called Axeleo Scale , while the fund is called Axeleo Capital . And it’s important to mention both parts of the business as they work hand in hand. Axeleo picks up around 10 startups per year and help them reach the Series A stage. If they’re doing well over the 12 to 18 months of the program, Axeleo funds those startups using its VC fund. Limited partners behind the company’s first fund include Bpifrance through the French Tech Accélération program, the Auvergne-Rhône-Alpes region, Vinci Energies, Crédit Agricole, BNP Paribas, Caisse d’Épargne Rhône-Alpes as well as various business angels and family offices. The firm is also partnering with Hi Inov, the holding company of the Dentressangle family. Axeleo will take care of the early stage in...
Post a Comment
Read more

TikTok’s rivals in India struggle to cash in on its ban

For years, India has served as the largest open battleground for Silicon Valley and Chinese firms searching for their next billion users. With more than 400 million WhatsApp users , India is already the largest market for the Facebook-owned service. The social juggernaut’s big blue app also reaches more than 300 million users in the country. Google is estimated to reach just as many users in India, with YouTube closely rivaling WhatsApp for the most popular smartphone app in the country. Several major giants from China, like Alibaba and Tencent (which a decade ago shut doors for most foreign firms), also count India as their largest overseas market. At its peak, Alibaba’s UC Web gave Google’s Chrome a run for its money. And then there is TikTok, which also identified India as its biggest market outside of China . Though the aggressive arrival of foreign firms in India helped accelerate the growth of the local ecosystem, their capital and expertise also created a level of competit...
Post a Comment
Read more