Did you know that by opening a site in Safari on Mac , you are potentially giving access to a hacker?
Earlier this week, the Dropbox disclosed information about three major vulnerabilities found in Apple's macOS operating system. The vulnerabilities could allow an attacker to gain remote access to a targeted Mac by convincing the victim to visit a malicious web page.
All the information regarding the Mac vulnerabilities was discovered by Syndis, one of the largest cybersecurity companies. Specifically, Dropbox hired Syndis to conduct simulated penetration testing attacks on Apple on Macs.
The vulnerabilities were discovered and pointed out to Apple’s security team earlier in February, which were promptly patched by Apple a month later. Dropbox thanked the company for its prompt action to fix the bug.
According to Dropbox, the aforementioned vulnerabilities not only affected macOS but also Safari running the latest version of the web browser.
Here are the three published vulnerabilities:
1. The first flaw concerns the CoreTypes component of macOS that automatically allows the Safari web browser to download and upload a disk image to the visitor's system, via a malicious website.
2. The second flaw concerns the way the disk image handles .bundle files, which are applications and appear as directories. This flaw could allow an attacker to distribute a malicious application.
3. The third flaw concerns a bypass of the anti-malware included in macOS, which allows a malicious application to bypass the protection code and execute a malicious version of the final application that leads to arbitrary commands.
Apple has reviewed all security and has implemented the necessary bug fixes. Our advice? The only thing you can do on your part, for greater security, is to update your Mac in a timely manner to avoid any threat.
