Microsoft recently disclosed a security vulnerability known as “HM Surf,” which affects Apple’s macOS operating system. This vulnerability allows hackers to bypass privacy controls in the Safari browser, posing a risk of unauthorized access to users’ data. Apple has since addressed the issue and released a security patch.
According to reports from The Hacker News, the HM Surf vulnerability is connected to Apple’s Transparency, Consent, and Control (TCC) privacy management system. This system is designed to protect users by requiring applications to obtain permission before accessing sensitive information.
Microsoft identified that attackers could exploit the HM Surf vulnerability using the “dscl” tool, which enables them to modify the user’s home directory without needing TCC access. This manipulation allows hackers to alter critical configuration files within the Safari folder, such as PerSitePreferences.db. In some cases, attackers could even gain control of the device’s camera and microphone, recording audio and video without the user’s consent. Notably, third-party browsers like Chrome and Firefox are not affected by this issue, as they do not operate under the same permission framework as Safari.
Additionally, Microsoft highlighted the potential exploitation of this vulnerability by a type of adware known as AdLoad. In response, Apple has released the macOS Sequoia 15 update, which removes the vulnerable code and helps safeguard user data. To ensure protection, it is strongly recommended that users update their macOS to the latest version.
