Microsoft Discovered New 'Powerdir' macOS Vulnerability, Fixed in 12.1 Update

[MacRumors]

Microsoft's 365 Defender Research Team this morning published details on a new "Powerdir" macOS vulnerability that let an attacker bypass the Transparency, Consent, and Control technology to gain unauthorized access to protected data.

Apple already addressed the CVE-2021-30970 vulnerability in the macOS Monterey 12.1 update that was released in December, so users who have updated to the latest version of Monterey are protected. Those who have not done so should update. Apple in its security release notes for the 12.1 update confirmed the TCC vulnerability and credited Microsoft with its discovery.

According to Microsoft, the "Powerdir" security flaw could allow a fake TCC database to be planted. TCC is a long running macOS function that lets users configure the privacy settings of their apps, and with the fake database, a malicious person could hijack an app installed on a Mac or install their own malicious app, accessing the microphone and camera to obtain sensitive info.

Microsoft has a detailed outline of how the vulnerability works, and the company says that its security researchers continue to "monitor the threat landscape" to discover new vulnerabilities and attacker techniques that affect macOS and other non-Windows devices.

"Software vendors like Apple, security researchers, and the larger security community, need to continuously work together to identify and fix vulnerabilities before attackers can take advantage of them," wrote Microsoft's security team.

Article Link: Microsoft Discovered New 'Powerdir' macOS Vulnerability, Fixed in 12.1 Update

 

[cal6n]

Does it need root? Because that is what JBO is running as.

 

[JosephAW]

Wondering if we’ll get a security update on older MacOS

 

[MacNerd01]

Well, i guess I shall begin updating my expansive mac collection

 

[MacNerd01]

Wondering if we’ll get a security update on older MacOS

I hope so.

Not sure if the vulnerability is exclusive to Monterey, though.

 

[Robert.Walter]

What about Catalina? It’s received security updates as of late but is this fix in one of them?

 

[kobaltz]

Wondering if we’ll get a security update on older MacOS

From the CVE

A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.1, macOS Big Sur 11.6.2. A malicious application may be able to bypass Privacy preferences.

So, it was back ported to Big Sur, but I dunno about Catalina or others.

 

[BWhaler]

Love to see Microsoft, Google, and Apple working together for our safety and security.

You just know companies like Facebook and Verizon would exploit these holes—and probably do.

 

[minik]

What about Catalina? It’s received security updates as of late but is this fix in one of them?

There were some TCC-related fixes according to the releases note but the CVE numbers are different.

 

[Realityck]

At least they were smart in post announcement of a vulnerability already fixed. As others have commented all major companies need to work together on security remedies when discovered.

 

[sw1tcher]

Love to see Microsoft, Google, and Apple working together for our safety and security.

I'm confused. We like Microsoft and Google now? They're now our friends?

 

[BootsWalking]

Does it need root? Because that is what JBO is running as.

It does require root, but the purpose of OSX's SIP is to protect against such exploits even by a root user, so this exploit is a vulnerability that bypasses SIP.

 

[B4U]

Considering Mojave is the last Mac OS that supports 32 bit apps, hopefully they will backport this fix to that OS as well.
Apple can do a better job of letting us know when an OS is actually no longer supported.

 

[pretzel.revival_0j]

Microsoft's 365 Defender Research Team this morning published details on a new "Powerdir" macOS vulnerability that let an attacker bypass the Transparency, Consent, and Control technology to gain unauthorized access to protected data.

Apple already addressed the CVE-2021-30970 vulnerability in the macOS Monterey 12.1 update that was released in December, so users who have updated to the latest version of Monterey are protected. Those who have not done so should update. Apple in its security release notes for the 12.1 update confirmed the TCC vulnerability and credited Microsoft with its discovery.

According to Microsoft, the "Powerdir" security flaw could allow a fake TCC database to be planted. TCC is a long running macOS function that lets users configure the privacy settings of their apps, and with the fake database, a malicious person could hijack an app installed on a Mac or install their own malicious app, accessing the microphone and camera to obtain sensitive info.

Microsoft has a detailed outline of how the vulnerability works, and the company says that its security researchers continue to "monitor the threat landscape" to discover new vulnerabilities and attacker techniques that affect macOS and other non-Windows devices.

"Software vendors like Apple, security researchers, and the larger security community, need to continuously work together to identify and fix vulnerabilities before attackers can take advantage of them," wrote Microsoft's security team.

Article Link: Microsoft Discovered New 'Powerdir' macOS Vulnerability, Fixed in 12.1 Update

Shouldn’t MSFT focus on finding and addressing their own security holes?

 

[zorinlynx]

Does it need root? Because that is what JBO is running as.

Yeah I mean really. What exactly are they exploiting? They're already root. It the equivalent of a burglar already in your house stealing something out of your fridge.

 

[metapunk2077fail]

Oh shoot does it mean I can't use my older Macs with internet.

 

[Analog Kid]

Yeah I mean really. What exactly are they exploiting? They're already root. It the equivalent of a burglar already in your house stealing something out of your fridge.

It’s closer to being equivalent to a burglar in your home planting cameras and microphones before leaving.

 

[NightFox]

Shouldn’t MSFT focus on finding and addressing their own security holes?

They do, but they also have the Defender 365 Research Team who purely assess third party products like this.

 

[Stella]

Shouldn’t MSFT focus on finding and addressing their own security holes?

Microsoft are large enough to do both, and more.

 

[pretzel.revival_0j]

Microsoft are large enough to do both, and more.

They should reallocate their resources and focus more on their own vulnerabilities. There are a disproportionate number of windows security holes vs macOS security issues.

 

[MacNerd01]

I'm confused. We like Microsoft and Google now? They're now our friends?

Just because this is an apple-focused site doesn’t mean we hate other companies.

 

[KaliYoni]

I'm OK with MSFT using some of its massive financial and technical resources to find security and privacy problems anywhere. Doing so helps all of us. In fact, I think it's better than having an unspoken support time span for older OS versions and ghosting Mojave users for the last 18 months.

----------
For anybody interested, this is a good history of Apple's macOS support:

How long does Apple support macOS?

Unofficially, each major version of macOS gets a year’s full support, with bug and security fixes, then 2 years of security updates. Is that how it works?

eclecticlight.co

 

[profcutter]

From the CVE

A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.1, macOS Big Sur 11.6.2. A malicious application may be able to bypass Privacy preferences.

So, it was back ported to Big Sur, but I dunno about Catalina or others.

Seems like this detail should be added to the original article. I‘m updating now to 11.6.2.

 

[sw1tcher]

Just because this is an apple-focused site doesn’t mean we hate other companies.

You must be new here.

*checks MacNerd01's join date*

Yup.

?

 

[coolfactor]

TCC is 10 years old now, and today is the first time that I've heard of it. ?

Here's an article from months ago talking about its history, design and weaknesses...

Bypassing macOS TCC User Privacy Protections By Accident and Design - SentinelLabs

TCC is meant to protect user data from unauthorized access, but design flaws mean users and malware can bypass TCC, even by accident.

www.sentinelone.com

I'm surprised that Apple is using an SQL database for this. They have used XML-based plists (ie. "property lists") forever, and then took over the FoundationDB project, which I always thought would be fast, efficient and secure replacement. (Why isn't FoundationDB being used yet? Anyone know? Is it overkill?)

SQLite is a solid embedded database solution, but this seriously feels like a weakness when the database itself can be compromised simply by replacing a file on disk.