Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

MacRumors

macrumors bot
Original poster
Apr 12, 2001
58,710
22,365


Microsoft's 365 Defender Research Team this morning published details on a new "Powerdir" macOS vulnerability that let an attacker bypass the Transparency, Consent, and Control technology to gain unauthorized access to protected data.

powerdir-exploit-microsoft.jpg

Apple already addressed the CVE-2021-30970 vulnerability in the macOS Monterey 12.1 update that was released in December, so users who have updated to the latest version of Monterey are protected. Those who have not done so should update. Apple in its security release notes for the 12.1 update confirmed the TCC vulnerability and credited Microsoft with its discovery.

According to Microsoft, the "Powerdir" security flaw could allow a fake TCC database to be planted. TCC is a long running macOS function that lets users configure the privacy settings of their apps, and with the fake database, a malicious person could hijack an app installed on a Mac or install their own malicious app, accessing the microphone and camera to obtain sensitive info.

Microsoft has a detailed outline of how the vulnerability works, and the company says that its security researchers continue to "monitor the threat landscape" to discover new vulnerabilities and attacker techniques that affect macOS and other non-Windows devices.

"Software vendors like Apple, security researchers, and the larger security community, need to continuously work together to identify and fix vulnerabilities before attackers can take advantage of them," wrote Microsoft's security team.

Article Link: Microsoft Discovered New 'Powerdir' macOS Vulnerability, Fixed in 12.1 Update
 

kobaltz

macrumors newbie
Jul 27, 2010
21
182
Wondering if we’ll get a security update on older MacOS:rolleyes:
From the CVE

A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.1, macOS Big Sur 11.6.2. A malicious application may be able to bypass Privacy preferences.

So, it was back ported to Big Sur, but I dunno about Catalina or others.
 

BWhaler

macrumors 68040
Jan 8, 2003
3,770
6,168
Love to see Microsoft, Google, and Apple working together for our safety and security.

You just know companies like Facebook and Verizon would exploit these holes—and probably do.
 
  • Like
Reactions: u+ive

pretzel.revival_0j

macrumors newbie
Jan 10, 2022
2
-6


Microsoft's 365 Defender Research Team this morning published details on a new "Powerdir" macOS vulnerability that let an attacker bypass the Transparency, Consent, and Control technology to gain unauthorized access to protected data.

powerdir-exploit-microsoft.jpg

Apple already addressed the CVE-2021-30970 vulnerability in the macOS Monterey 12.1 update that was released in December, so users who have updated to the latest version of Monterey are protected. Those who have not done so should update. Apple in its security release notes for the 12.1 update confirmed the TCC vulnerability and credited Microsoft with its discovery.

According to Microsoft, the "Powerdir" security flaw could allow a fake TCC database to be planted. TCC is a long running macOS function that lets users configure the privacy settings of their apps, and with the fake database, a malicious person could hijack an app installed on a Mac or install their own malicious app, accessing the microphone and camera to obtain sensitive info.

Microsoft has a detailed outline of how the vulnerability works, and the company says that its security researchers continue to "monitor the threat landscape" to discover new vulnerabilities and attacker techniques that affect macOS and other non-Windows devices.

"Software vendors like Apple, security researchers, and the larger security community, need to continuously work together to identify and fix vulnerabilities before attackers can take advantage of them," wrote Microsoft's security team.

Article Link: Microsoft Discovered New 'Powerdir' macOS Vulnerability, Fixed in 12.1 Update

Shouldn’t MSFT focus on finding and addressing their own security holes?
 

KaliYoni

macrumors 65816
Feb 19, 2016
1,033
2,320
I'm OK with MSFT using some of its massive financial and technical resources to find security and privacy problems anywhere. Doing so helps all of us. In fact, I think it's better than having an unspoken support time span for older OS versions and ghosting Mojave users for the last 18 months.

----------
For anybody interested, this is a good history of Apple's macOS support:
 
Last edited:

profcutter

macrumors 65816
Mar 28, 2019
1,179
828
From the CVE

A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.1, macOS Big Sur 11.6.2. A malicious application may be able to bypass Privacy preferences.

So, it was back ported to Big Sur, but I dunno about Catalina or others.
Seems like this detail should be added to the original article. I‘m updating now to 11.6.2.
 
  • Like
Reactions: EmotionalSnow

coolfactor

macrumors 603
Jul 29, 2002
5,684
6,509
Vancouver, BC
TCC is 10 years old now, and today is the first time that I've heard of it. ?

Here's an article from months ago talking about its history, design and weaknesses...

I'm surprised that Apple is using an SQL database for this. They have used XML-based plists (ie. "property lists") forever, and then took over the FoundationDB project, which I always thought would be fast, efficient and secure replacement. (Why isn't FoundationDB being used yet? Anyone know? Is it overkill?)

SQLite is a solid embedded database solution, but this seriously feels like a weakness when the database itself can be compromised simply by replacing a file on disk.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.