Apple Fixed Two Actively Exploited Vulnerabilities in macOS 12.3.1 Monterey, But Hasn't Released Updates for Big Sur or Catalina

[MallardDuck]

Mac security is full of misinformation and meh products, especially on the consumer end of things. Gatekeeper helps, but is only one layer of defense (that has gaps). Xprotect is another layer, but also has gaps (and is slow). Consumer-grade software falls into two categories - stuff like Little Snitch that does one thing well, but isn't a complete solution, and legacy all-in-one stuff that, well, isn't exactly the best. You really want to protect a mac? Buy a commercial grade solution like Crowdstrike.

This is a major issue with Apple though - without a published support plan, everyone is at the mercy of their goodwill. We get hardware lifespans...really need software ones too.

 

[MallardDuck]

For systems running those older versions of operating systems, I'm sure the macOS operating system is not the only vulnerable aspect. There are probably older versions of applications that can't be updated / upgraded that also have vulnerabilities that the owner may not be aware of. I have an iMac that I got a good 9 years before Apple dropped support for it. It runs macOS Catilina I still use it for non-critical things. By continuing to use (for non-critical things) that's a risk I'm accepting. I don't blame Apple for not providing software updates for an 11 year old system.

Me either. Supporting multiple legacy code bases cost money, and without a continuing revenue stream, it's just not economically viable to do so. Like it or not, security fixes are a reason to keep current on both hardware and software. part of modern living. Microsoft even cuts off paying customers eventually when the costs get too high.

The big nuance with Apple is that they've dropped 32-bit support completely. That created a hard line of obsolesce. Microsoft will eventually do the same, and that's going to be a major jump (just look at the outcry on Win 11's requirements).

 

[JPack]

Apple, a nearly $3 trillion company, with limited engineering resources? ?

How is it that a smaller company like Microsoft can offer a much longer support window than Apple? Take a look at Windows 10. It came out on Jul 29, 2015 and Microsoft will be supporting it until Oct 14, 2025

5 years of mainstream support from the release date and 10 years of extended support is pretty darn impressive.

If Apple didn't have limited resources, we'd see an Apple 5G modem three years ago.

The iOS 13 launch disaster wasn't by choice.

M1 Macs being bricked by Monterey wasn't by choice either.

Money doesn't buy everything.

 

[MallardDuck]

Apple, a nearly $3 trillion company, with limited engineering resources? ?

How is it that a smaller company like Microsoft can offer a much longer support window than Apple? Take a look at Windows 10. It came out on Jul 29, 2015 and Microsoft will be supporting it until Oct 14, 2025

5 years of mainstream support from the release date and 10 years of extended support is pretty darn impressive.

No, that's not right. That 2025 date is when the last version of Windows 10 will leave support, not the first. The version that came out on 7/29/15 was only supported until 5/9/17. Not even two years. Don't confuse marketing names with supported versions - Microsoft made a conscious decision to not increment the marketing name Windows 10 for many years, even though the current release is substantially different from the original release. Get ready for three year old machines that don't meet the Windows 11 hardware requirements to be EOS in 2025.

 

[B4U]

Wish they still actively supported macOS Mojave.. Folks still use that OS for certain things (32 bit apps, dashboard, iTunes, etc)

I am in the same boat.
iTunes can be installed with Retroactive, which sounds like a slight relieve.
Just a side note. Meanwhile, iTunes 12.6.5.3 still works on the Windows side where it can download the apps and sync to multiple devices. On the other hand, the same iTunes had been broken on the Mac side for over 2 years. Why, Apple? WHY?
Dashboard is another one I use often enough where the notification is not a replacement.
Sadly, even the paid apps don't work close to that.

 

[Rafterman]

Hint, hint.

 

[lightbreakerD]

The Windows 10 that came out in 2015 hasn’t been supported since 2017.

New major Windows versions are available for every pc, so Windows 24H2 that will be released in 2024, will be available for every current pc that can run windows 10.

My MBP from 2012 runs MacOS Catalina, the newest MacOS it can run. It was released in 2019.
My Bootcamp partition runs Windows 10 21H2 (released in 2021) flawlessly and will be officially supported by Windows until at least 2025.

I would rather run an officially supported version of MacOS but Apple doesn't let me upgrade to Big Sur or later.

 

[ian87w]

Every company has limited engineering resources and Apple is no different.

Ideally, everything is updated at the same time with no bugs. Realistically, Apple needs to focus on the latest OS and most recent devices.

Understandable if Apple were a small startup. But Apple is a trillion dollar company charging ultra premium prices for their products with the promise of "it just works."

Furthermore, Apple was able to develop a mass scanning system without any prompts. Yet they are unable to address real security issues in a timely manner? Kinda made it look like Apple has a really distorted priorities.

For me, the least Apple could've done is provide explanations. Be transparent on what the issues and why they are delayed. Just be honest about it. Apple's total opaqueness is not helping anyone.

 

[Robert.Walter]

MacOS has had a surprisingly tough go of fitting into the annual release cycle. They make mountains out of molehills at WWDC, going ga-ga over stuff that could've been added to the OS as part of a point release (Universal Control notwithstanding, although ironically that *was* added as a point release).

I think Apple should make macOS just macOS, support hardware as long as they can, tease a couple of upcoming features at WWDC, and gradually roll off Macs that are 8-10 years old.

And if you can't do that, at least stop with the California-inspired names. Time for a change.

I’ve been asking for years that they just call it MacOS 21, then next year MacOS 22. (And same for all Apple OS’s. And same for products, ie we’d have had iPhone 21, iPad 21, Mac 21, Apple Watch 21 and AirPods 21 all launching last year.)

If they were using this syntax we’d be on macOS 21.3.1 now.

With “macOS yy.x.z Place Name”, Apple could add the place name after the model year and revision descriptors. This would be way more common sense and user-friendly rememberable then the abstract place names.

Relying on abstract place names as a major identifier is as blindingly stupid as the WHO going to random Greek letters to describe Covid variants as opposed to calling them variant 1, 2, 3, etc.

 

[cwt2nospam]

Yeah I’m in the same situation have to stay in Mojave. Dual booting would be awkward just to run key software.
In other Unix OS that are 64 bit I can still run some 32 bit binaries by compiling or installing missing libraries. Why can’t we do that for MacOS?

When you compile/install other libraries you may get the capabilities you need/want, but you're also getting their vulnerabilities. Doing the same thing on the MacOS would also compromise security, and the point is to increase security, not decrease it.

 

[falkon-engine]

For systems running those older versions of operating systems, I'm sure the macOS operating system is not the only vulnerable aspect. There are probably older versions of applications that can't be updated / upgraded that also have vulnerabilities that the owner may not be aware of. I have an iMac that I got a good 9 years before Apple dropped support for it. It runs macOS Catilina I still use it for non-critical things. By continuing to use (for non-critical things) that's a risk I'm accepting. I don't blame Apple for not providing software updates for an 11 year old system.

Windows 10 still gets security Updates and runs on hardware older than 9 years old. Stop making excuses for apple.

 

[fahlman]

Wish they still actively supported macOS Mojave.. Folks still use that OS for certain things (32 bit apps, dashboard, iTunes, etc)

Apple first supported 64-bit applications 18 years ago in 2004 with the release of Mac OS 10.4 Tiger. It wasn't until 15 years later (15 freaking years!), and after many reminders and warnings to developers, that macOS 15 Catalina ended support for 32-bit applications. If you have a mission critical application that is 32-bit then the vendor has stopped supporting the application and either hopes you're oblivious and/or plain doesn't care about their client base. It won't be too long before Rosetta disappears and all applications will need to be Apple silicon compatible. Do you think the vendor who still ships a 32-bit only application has any intention to port their application? The answer is "No". Do yourself a favor a find a similar application by a developer who gives a d@mn about their users.

 

[fahlman]

Windows 10 still gets security Updates and runs on hardware older than 9 years old. Stop making excuses for apple.

The latest supported consumer version of Windows 10 is 20H2, for which support ends in a couple months, by the way, requires at least a processor released in 2015, seven years ago.

macOS Monterey supports every Mac released since... you guessed it... at least 2015.

 

[lysingur]

If you really think about it, it's crazy that Apple only supports one major macOS release for three years then full stop.

 

[Madhatter32]

If you really think about it, it's crazy that Apple only supports one major macOS release for three years then full stop.

Agreed. I would prefer to pay for the new release if it meant longer security support. That way I could enjoy a reliable, bug-free, secure OS for longer period rather than having to "upgrade" to an unreliable, bug-filled, secure OS every few years.

 

[lysingur]

The latest supported consumer version of Windows 10 is 20H2, for which support ends in a couple months, by the way, requires at least a processor released in 2015, seven years ago.

macOS Monterey supports every Mac released since... you guessed it... at least 2015.

Windows 10 on a base model desktop from 2015 runs much faster than macOS Monterey on a similar configuration. Just because you can have 5 tabs open in Safari while also checking your email and listening to Apple Music doesn't mean it runs well.

Also, the first 1GHz CPU came out a lot earlier than 2015. Where did you get that year from?

 

[Westside guy]

Then the question becomes how to PREVENT this from happening in 10.13. Granted I almost exclusively use Winders on my mini (10 runs better than the macOS ever really did)...

Without details - and Apple never gives much in the way of details - it's hard to tell for sure, but these look likely to be local privilege escalation exploits. So...

1) They're less likely to be an issue if you're the only user on your computer.
2) Use actively-updated software for any internet activities. So do not use Safari, for example - use Firefox or (ugh) Chrome. Don't use Apple Mail, and use alternatives to Messages if possible.
3) Turn off screen sharing, file sharing, etc.
4) For day to day stuff, run as a non-admin user account (it's easy enough to invoke an admin account when necessary)
5) Don't do dumb things like grab software from warez/torrents sites.

That at least lowers your risk profile.

 

[RandomTox]

Issues with the mouse and strange video artefacts with resized video screen. Update at your own risk. Regret I updated.

 

[RandomTox]

Apple cares more about money than their users. Pretty simple. They're telling Mac users to "Buy a new machine or get f'd."

That's exactly what Tim&Co did to Apple under her/his/it leadership. Zero innovation. Squeezing the last $ from the current ecosystem and its loyal users. Not sustainable.

 

[chucker23n1]

New major Windows versions are available for every pc, so Windows 24H2 that will be released in 2024, will be available for every current pc that can run windows 10.

If a Windows 10 24H2 does happen, keep in mind that it (and the releases in between) won't contain major features compared to the current Windows 10 21H2, because Windows 11 is the current OS now.

In any case, all I was really responding to was the claim that the Windows 10 of 2015 gets supported for ten years. That isn't true; the OS has changed significantly since, and upgrading straight from the original version 1507 to current isn't a smooth ride. It really isn't that different than upgrading from macOS El Capitan to Monterey.

My MBP from 2012 runs MacOS Catalina, the newest MacOS it can run. It was released in 2019.
My Bootcamp partition runs Windows 10 21H2 (released in 2021) flawlessly and will be officially supported by Windows until at least 2025.

I would rather run an officially supported version of MacOS but Apple doesn't let me upgrade to Big Sur or later.

FWIW, my late-2013 runs Monterey using OCLP. Can't really complain.

 

[ian87w]

Apple cares more about money than their users. Pretty simple. They're telling Mac users to "Buy a new machine or get f'd."

Unfortunately this will be the impression some people get if Apple remains opaque about these. Apple's secrecy was fine when Jobs was around as his reality distortion field took care of everything. But without that, and the fact that Apple is a much larger and richer company, it just gives a much more bitter taste for many users.

 

[MajorFubar]

Some say that 32bit support on Mojave is not as good as on High Sierra... I heard there might be some limitations but I am not sure what those limitations are...

This is why I will forever keep an old laptop running High Sierra so I can use my 32-bit apps. Chiefly CS6 which I paid good money for, I have no interest in migrating to Adobe's subscription model.

 

[ian87w]

This is why I will forever keep an old laptop running High Sierra so I can use my 32-bit apps. Chiefly CS6 which I paid good money for, I have no interest in migrating to Adobe's subscription model.

If your licenses are good for Windows version as well, you can set up a boot camp partition with Windows for those Adobe apps, and have your macOS portion to get upgraded.

Having said that, I do agree High Sierra is one of the best macOS version in terms of stability and speed.

 

[laptech]

If owners of macs still using macOS Big Sur and macOS Catalina get attacked then i have no doubt Apple will use some PR bs saying it's the owners fault for not upgrading their hardware to use the latest secuirty fixed macOS

 

[oldmacs]

This is terrible on Apple's part because even Mac users who stay within the last two releases of macOS are, often unknowingly as Intego's research revealed, put at risk. Worse, the lack of any written support timeline makes it impossible to have any kind of rational upgrade plan.

This is so true. It's really infuriating! Mojave also randomly stopped getting updates months before the unofficial cut off.

And those who cannot legit upgrade past 10.13 are...???

Sadly left in the dust.