Microsoft found a macOS TCC "powerdir" security flaw that leads to settings hack

macOS Monterey written on a colorful background

Microsoft published a blog post yesterday detailing a new macOS Monterey security vulnerability that was discovered by Jonathan Bar Or, a senior security researcher at the Redmond company. The flaw, dubbed "powerdir", was present in the OS' Transparency, Consent, and Control (TCC) technology. This could be exploited by threat actors and attackers to gain unauthorized access to user data.

Microsoft uncovered a new macOS vulnerability, “powerdir,” that could allow an attacker to bypass the operating system’s Transparency, Consent, and Control (TCC) technology, thereby gaining unauthorized access to a user’s protected data.

The macOS TCC is essentially a user data privacy and protection management technology that helps to control an app's access to user data. Hence, no one in their right mind would want a hacker to gain control over it.

While the details about this discovery were published yesterday, Microsoft had already alerted Apple about its findings earlier. The Cupertino giant has fixed the issue in its December 2021 macOS Monterey 12.1 update under the assigned ID "CVE-2021-30970". The changelog for this bug fix reads:

TCC

Available for: macOS Monterey

Impact: A malicious application may be able to bypass Privacy preferences

Description: A logic issue was addressed with improved state management.

CVE-2021-30970: Jonathan Bar Or of Microsoft

There are also several other security fixes in this release and many of them for the TCC too. The macOS Monterey 12.1 update also brings many new features that you can read about here.

Source: Microsoft

Report a problem with article
Concept of Apple&039s upcoming ARVR Headset
Next Article

Apple's upcoming AR/VR headset may use the same 96W power adapter as the 14-inch MacBook Pro

Bitcoin Ethereum and Ripple coins and SD card on grey background
Previous Article

Research suggests quite a number of people would like to be paid in bitcoin

1 Comment - Add comment

Advertisement