Cisco Talos has identified serious security vulnerabilities in several Microsoft apps for macOS, potentially allowing attackers to spy on users. The vulnerabilities affect popular applications like Word, Outlook, Excel, OneNote, and Teams. These flaws enable attackers to inject malicious code, exploiting permissions granted by the user to access the microphone, camera, and other system components.
Potential Threats The vulnerabilities are particularly concerning because they allow attackers to perform actions such as recording audio or video without the user's knowledge, accessing sensitive data, and sending unauthorized emails. For example, Microsoft Teams could be exploited to record conversations, while Outlook could lead to data breaches if compromised.
The primary issue lies with a feature called the com.apple.security.cs.disable-library-validation entitlement, which disables security measures that prevent the loading of unsigned or untrusted libraries. This makes the applications vulnerable to library injection attacks, where malicious code is inserted into legitimate processes.
Microsoft’s Response Microsoft has acknowledged these vulnerabilities but considers them low risk. While some apps, like Microsoft Teams and OneNote, have been updated to reduce vulnerability by removing this entitlement, others, including Word, Excel, Outlook, and PowerPoint, remain susceptible. Microsoft has reportedly declined to fix the issue in these apps due to their need to support plugins that require loading unsigned libraries.
Understanding macOS Security Apple’s macOS employs a layered security model designed to protect users from unauthorized access and data breaches. Key components include the Transparency, Consent, and Control (TCC) framework, which governs app access to sensitive data, and Discretionary Access Control (DAC) policies that restrict resource access based on user permissions.
However, these security measures can be circumvented when apps are granted excessive permissions or security policies are bypassed. The vulnerabilities in Microsoft’s macOS apps could lead to unauthorized access to sensitive data, emphasizing the need for vigilant security practices.
For users, staying protected involves ensuring that all apps are regularly updated to the latest versions, which often include critical security patches. These findings also serve as a reminder to developers about the importance of adhering to best security practices to avoid compromising user data.
