A critical vulnerability in Apple 's iOS operating system , known as CVE-2024-44131, has come to light, allowing malicious apps to gain access to sensitive user data in iCloud without any warning.
The problem is located in the Transparency, Consent, and Control (TCC) subsystem, which is designed to ensure privacy by asking users for permission when apps attempt to access personal data, such as photos, GPS location, and contacts.
Read more: Hackers exploit vulnerability in Apple Safari
The vulnerability results from a bypass in the TCC mechanism, which allows access to files, health data, microphones and cameras without the user's consent. The exploit leverages symlinks in the Files application and the fileproviderd process, allowing malicious applications to mislead the system and redirect file operations without any warning.
This security flaw is particularly concerning as it affects both macOS and iOS, exposing critical data such as WhatsApp chat backups, Pages documents, and files stored in iCloud Drive. Apple has already released security updates to fix the issue in iOS 18 and macOS 15, urging users to update their devices immediately.
For businesses, this vulnerability highlights the importance of adopting a comprehensive security strategy for mobile devices, as they are not inherently protected. Jamf Threat Labs recommends using specialized security solutions that monitor application behavior and prevent unauthorized access.
See more: iOS 18.1: How to record and transcribe calls?
The TCC issue is a stark reminder of the continued growth of mobile threats. Data protection at all levels is now more critical than ever, especially in an increasingly connected digital world.
Source: cybersecuritynews
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
