Hackers Could Potentially Attain Unrestricted Entry Through New Deficiencies in Microsoft macOS Applications
Researchers have unveiled eight vulnerabilities in Microsoft macOS apps that hackers could exploit to achieve increased privileges or access confidential information by bypassing the permission-based model of the operating system, which centers around the Transparency, Consent, and Control (TCC) framework.
Cisco Talos expressed in a statement, “If successful, bad actors could acquire any privileges that are already authorized to the impacted Microsoft applications. They can, for instance, send emails from the user account imperceptibly, capture audio snippets, capture images, or film videos without any user intervention.”
The deficiencies affect various apps such as Outlook, Teams, Word, Excel, PowerPoint, and OneNote.
The cybersecurity firm stated that malevolent libraries could be inserted into these applications to acquire their rights and user-sanctioned authorizations, which could then be exploited to extract sensitive data based on the permissions assigned to each of these applications.
TCC is an Apple-developed framework that administers access to private user records on macOS, providing users with additional visibility into how their information is accessed and handled by different applications installed on the device.
This data is managed through an encrypted database that saves the approvals given by the user to each application to ensure that the choices are consistently enforced across the system.
“TCC works together with the application sandboxing functionality in macOS and iOS,” observed Huntress in its explanation of TCC. “Sandboxing confines an app’s reach to the system and other apps, providing an added layer of protection. TCC ensures apps can only retrieve data for which they have explicit user consent.”
Additionally, sandboxing serves as a defense mechanism against code injection, allowing intruders with host access to inject malicious code into legitimate processes and reach restricted data.
Francesco Benvenuto, a researcher at Talos, mentioned, “Library injection, also referred to as Dylib Hijacking within the macOS context, involves inserting code into an application’s operational process. macOS counters this threat using features like hardened runtime, which lowers the chance of attackers executing arbitrary code through a different app’s process.”
“Nevertheless, if an attacker successfully inserts a library into another app’s running process space, this library can utilize all the permissions previously granted to that process, effectively functioning on behalf of the application itself.”
It’s important to note that these types of attacks require the threat actor to possess a certain level of access to the compromised host to essentially exploit it for opening a more privileged app and introducing a detrimental library, thereby granting them the authorizations linked with the compromised app.
In simpler terms, if a trustworthy app is infiltrated by an attacker, it can be manipulated to misuse its permissions and attain unsolicited entry to confidential data without the users’ authorization or awareness.
This form of breach may arise when an app loads libraries from locations that the attacker could potentially control and has disabled library authentication via a risky privilege (i.e., switched to true), which typically confines library loading to those sanctioned by the app’s developer or Apple.
“macOS trusts applications to self-regulate their authorizations,” pointed out Benvenuto. “Any failure in this responsibility leads to a breakdown of the entire permission model, as applications inadvertently act as conduits for illicit actions, evading TCC and jeopardizing the system’s security model.”
Microsoft views the identified concerns as “low risk” and states that these apps need to load unsigned libraries for plugin support. Nevertheless, the company has intervened to fix the issues in its OneNote and Teams applications.
“These vulnerable apps create an opportunity for threat actors to exploit all the apps’ authorizations and, without any user alerts, reuse all the permissions already granted to the app, essentially acting as a permission broker for the attacker,” highlighted Benvenuto.
Benvenuto added, “It’s worth mentioning that determining how to securely handle such plugins within macOS’ current framework is unclear. Verifying the security of third-party plugins through notarization is a possibility, although a complex one that necessitates Microsoft or Apple to approve third-party modules post-security checks.”
About Author
