Several vulnerabilities in the Safari web browser for macOS may have left users open to being spied on, having their data stolen, and acquiring other types of malware thanks to this security weakness.
Specifically, the vulnerability arises from the special permissions Apple gives to its proprietary apps, and here, it is the browser, as well as the ease with which an attacker can obtain the important configuration files of an app.
Ultimately, what it allows a user to do is to circumvent the Transparency, Consent, and Control (TCC) security layer on MacBooks that is designed to safeguard sensitive data from an attacker. CVE-2024-44133 has been rated as a "medium" severity vulnerability by the Common Vulnerability Scoring System (CVSS), meaning that it has a 5.5 severity score as per the CVSS.
According to the CVE-2024-44133 vulnerability report, attackers can bypass the user data protection methods implemented by the operating system by bypassing Transparency, Consent, and Control (TCC).
During the September 16 update for Mac Studio (2022 and later), iMac (2019 and later), Mac Pro (2019 and later), Mac Mini (2018 and later), MacBook Air (2020 and later), MacBook Pro (2018 and later), and iMac Pro (2017 and later), the vulnerability, also referred to as CVE-2024-44133, had been fixed.
Please take note that this vulnerability will only impact devices that are managed by Mobile Device Management (MDM), not any other device. Typically, MDM managed devices are subject to policies and procedures set by the IT department of an organization, which is responsible for centrally managing and maintaining the devices.
According to Microsoft, the flaw has been named "HM Surf." By exploiting this vulnerability an attacker would be able to bypass macOS' Transparency, Consent, and Control (TCC) features and gain unauthorized access to a user's protected data, which they would have no control over.
There is a possibility users may discover Safari's TCC in action while browsing a website that requires access to the camera or microphone when browsing through the website.
It was noted by Apple in mid-September that a bug in macOS Sequoia 15 has been fixed by removing the vulnerable code. However, the bug does not seem to affect MDM-managed devices.
As stated in the blog post, Microsoft’s Sequoia 15 release only protects Apple’s Safari web browser when it is installed.
It was also pointed out that browsers like Google Chrome and Mozilla Firefox don't have the same private entitlements as Apple applications, so they cannot bypass TCC checks like Apple applications can. Therefore, once TCC checks are approved, it is up to the app to maintain access to the privacy database as long as people have approved the checks.
This vulnerability can be exploited by removing the TCC protection for the Safari browser directory and editing a configuration file in that directory. It is stated in Microsoft's response that it involves gaining access to the user's data, such as browsed pages, the camera, microphone, and location of the device, without the user's knowledge.
Users of macOS are strongly encouraged to apply these security updates as soon as possible so that their system will be protected. Using its behavior monitoring capabilities, Microsoft Defender for Endpoint has detected activities associated with Adload, one of the most prevalent macOS threat families, which may be exploiting this vulnerability in some way. In addition to detecting and blocking CVE-2024-44133 exploitation, Windows Defender for Endpoint also detects and blocks anomalous modifications of the Preferences file through HM Surf or other mechanisms that potentially exploit the vulnerability.
According to Microsoft, it was TCC technology that first enabled them to learn how to bypass the technology when they discovered powerdir's vulnerability. Please remember that TCC, as its name implies, is a technology that prevents apps from accessing users' personal information when they are installed and that this includes services such as location services, camera and microphone devices, download directories, and others, without the user's knowledge or consent.
In the world of mobile applications, the only legal way for them to gain access to these services is by approving a popup through their user interface, or if they approve per-app access via the settings in their operating system.
This vulnerability, known as HM-Surf, may allow attackers to bypass key security features on macOS systems, which gives them a chance to gain access to sensitive data through the use of malicious code. It is possible that users who are not authorized to exploit the flaw could exploit macOS' own security functions, such as the sandboxing mechanisms and restrictions on file access.
HM-Surf exploit is a vulnerability that allows attackers to gain enhanced privileges, which allows them to access sensitive data and files that would otherwise require a login and password.
Initial warnings were raised about this vulnerability because it played a role in adware campaigns, where malicious actors used this loophole to install unwanted software on users' devices in order to profit from the vulnerability. There are, however, a lot more dangers than just adware; though, it is only the beginning. If the same vulnerability were weaponized, then it might even be used for more serious attacks, such as data exfiltration, surveillance, or even as a gateway to further malware infiltration in the near future.
There is probably no doubt that HM-Surf's unique ability to bypass Apple's robust security architecture is one of the most troubling aspects of this malware.
Security
macOS is widely regarded as a secure platform, but the recent discovery of the HM-Surf vulnerability shows that even advanced systems are not immune to evolving cyber threats. This finding serves as a crucial reminder for users and organizations to prioritize cybersecurity and adopt proactive measures to protect their digital environments.
Microsoft's cybersecurity team uncovered HM-Surf, an exploit posing a serious risk to macOS. Their investigation revealed a program altering Google Chrome settings to grant unauthorized microphone and camera access while collecting user and device data.
These actions suggested preparations for a second-stage payload that could further compromise the device.
The culprit was identified as the well-known macOS adware "AdLoad." This malware hijacks browser traffic, inundates users with ads, harvests data, and transforms infected devices into botnet nodes for further malicious activity. Although Microsoft's findings aligned with HM-Surf techniques, the researchers could not conclusively link AdLoad to actively exploiting the vulnerability.
Nevertheless, they warned that "attackers using a similar method to deploy a prevalent threat" underscored the need for enhanced protection.
The HM-Surf vulnerability illustrates the risks associated with macOS, highlighting that no operating system is invulnerable to sophisticated attacks. Exploiting such weaknesses could lead to severe consequences, including financial losses, reputational damage, and the exposure of sensitive data. The evolving nature of these threats suggests that attackers are continuously refining their methods to bypass security measures.
To address these challenges, organizations must adopt a multi-layered approach to cybersecurity. This includes regular system updates, comprehensive monitoring, and user education on safe practices. Deploying advanced threat detection and real-time monitoring can help detect and mitigate attacks before they cause significant harm. Regular security assessments can also identify and address potential vulnerabilities.
In summary, the emergence of the HM-Surf vulnerability is a stark reminder of the dynamic landscape of cybersecurity threats. For macOS users and businesses, this discovery emphasizes the need to act swiftly in strengthening defenses and protecting digital assets against evolving risks.
