A bug in developer API has been discovered which can install malicious apps in macOS Mojave and can hack the Safari browsing data.
Jeff Johnson, who developed Underpass Mac and iOS app, and also the extension, StopeTheMadness for Safari, discovered the bug which can affect all the versions of macOS Mojave.
Johnson said that there are certain folders which by default cannot be accessed like ~/Library/Safari. Even listing the content of folders is not possible in the Terminal app. Only a few apps can access this folder by default, Finder being one of them.
Protections are compromised and now apps can get access to ~/Library/Safari, without having to get any kind of permission from users or system, explained the developer. When there will be no permission, any malicious app can get access and steal the browsing history of the device, hurting the privacy of the users.
It is not possible to remotely hack it, but only the malicious apps on the system can do the exploitation.
A security researcher at Rapid7, Bob Rudis also talked about a trick that can bypass the restrictions of macOS 10.14. It was assumed that Johnson might have been talking about the same issue. But he clarifies that SSH issue discovered by Bob Rudis is different then what he is pointing at.
Photo: NurPhoto via Getty Images
Read next: Apple’s enterprise program continues to face challenges, now deals with pirated apps
Jeff Johnson, who developed Underpass Mac and iOS app, and also the extension, StopeTheMadness for Safari, discovered the bug which can affect all the versions of macOS Mojave.
Johnson said that there are certain folders which by default cannot be accessed like ~/Library/Safari. Even listing the content of folders is not possible in the Terminal app. Only a few apps can access this folder by default, Finder being one of them.
Protections are compromised and now apps can get access to ~/Library/Safari, without having to get any kind of permission from users or system, explained the developer. When there will be no permission, any malicious app can get access and steal the browsing history of the device, hurting the privacy of the users.
Related: A New Trojan Uses Antivirus Software to Steal DataAccording to Johnson, it only due to a bug in developer API and he has reported it to Apple’s security team. The team on the other side has acknowledged his report and has started working on its fixation.
It is not possible to remotely hack it, but only the malicious apps on the system can do the exploitation.
A security researcher at Rapid7, Bob Rudis also talked about a trick that can bypass the restrictions of macOS 10.14. It was assumed that Johnson might have been talking about the same issue. But he clarifies that SSH issue discovered by Bob Rudis is different then what he is pointing at.
Photo: NurPhoto via Getty Images
Read next: Apple’s enterprise program continues to face challenges, now deals with pirated apps
