January 11, 2022

The Microsoft 365 Defender Research Team has discovered a flaw known as powedir.

The bug, a macOS vulnerability, allows threat actors to gain access to the user’s protected data.

Attackers can do this by bypassing Transparency, Consent, and Control (TCC) technology. TCC was created to block apps from accessing sensitive user data.

The technology achieves this goal by allowing macOS users to configure privacy settings for the apps installed on their systems and devices connected to their Macs.

Apple has restricted TCC access to only apps with full disk access. Apple has also set up features to automatically block unauthorized code execution.

However, Microsoft researchers have shown that attackers can create a second, specially crafted TCC database that allows them to access protected user information.

“If exploited on unpatched systems, this vulnerability could allow a malicious actor to potentially orchestrate an attack based on the user’s protected personal data,” said Jonathan Bar Or, a principal security researcher at Microsoft.

For more information, read the original story in BleepingComputer.