Security researcher Felix Krause discovered a vulnerability in MacOS that allows hackers to take screenshots of screen activity and then switch to applications that have OCR to read the text.
Felix Krause explains that the CGWindowListCreateImage function can be used by any Mac application, regardless of whether it is sandboxed or not, to take screenshots without users knowing, even when the application itself is running in the Background.
The researcher says that a potential attacker could have access to all connected screens and could eventually read passwords and passcodes from the applications.
Needless to say, all other data is exposed, including emails and your personal information, such as banking details and contact details. The information contained in the hackers' screenshots can be automatically extracted with OCR software that reads text in photos.
Apple has already been notified of the bug, but the company has yet to respond, although a patch is expected to ship with the next Mac update.
As for the ways in which the error can be corrected, Krause explains that there are several ways, although he recommends three methods.
First of all, the App Store review process could verify the sandbox permissions for screen access, so only legitimate apps could do this, preventing any other malicious requests. Then, a window should appear informing the user of their permissions, and finally, a notification should appear whenever an app approaches the screen.
It remains to be seen what solution Apple will ultimately offer to this specific MacOS error.
