Webtagr - Technology News Summarizer

Popular：

Virtualization DNS security formal verification reachability analysis compiler errors macro conflict web extension development framework Bitmap Graphics API inconsistencies All Tags

macOS Permission Pop-Up Vulnerability: TCC, Who?

2025-05-12

A recently patched macOS vulnerability, CVE-2025-31250, allowed applications to spoof system permission pop-ups, tricking users into granting unauthorized access. Attackers exploited a flaw in Apple Events and the Transparency, Consent, and Control (TCC) system, separating the application displayed in the pop-up from the application actually receiving permissions. This vulnerability leveraged a logic error in the TCC daemon's handling of Apple Events permission requests, bypassing the need to create fake apps or override Dock shortcuts. The vulnerability has been patched, but highlights the complexity and potential risks in system permission management.

Critical macOS Flaw Leaks Passwords and iCloud Data via NetAuthAgent

2025-03-20

A security research article exposes a critical vulnerability in macOS (CVE-2024-54471) allowing attackers to steal file server credentials and even iCloud account information and API tokens via NetAuthAgent. The vulnerability stems from NetAuthAgent's MIG server failing to verify message senders, enabling attackers to send malicious messages to retrieve keychain credentials, subsequently accessing iCloud data including contacts, calendars, and location. The article details the Mach kernel, MIG mechanism, and exploitation process, urging users to update macOS to the latest version and enable Advanced Data Protection.