Tuesday, April 16, 2024

iOS/macOS Webcam Can be Hacked With A Single Click On Malformed Link – Hacker Rewarded $75,000

By just making the users visiting a link, an attacker can hack the users’ iOS/macOS Camera using zero-day bugs in Safari.

With iOS and macOS camera security model every app needs to assigned permission manually but Apple’s own app such as Safari gets access by default.

Security researcher Ryan Pickren discovered seven new vulnerabilities with Safari browser that allows attackers to access your device’s camera, microphone, or location, and in some cases, saved passwords as well.

iOS/macOS Webcam

Pickren said that Safari not using the method of the origin to keep track of the open website, “I deduced that Safari was likely running a Generic URI Syntax parser against all open windows to get the URIs’ hostnames, then doing some extra parsing on those.”

Exploiting Bugs to Access Camera

He started exploiting using javascript: data: and about, but that fails, but while parsing file: which specified for remote or FTP purpose(file://host.example.com/Share/path/to/file.txt).

iOS/macOS Webcam

Safari parses it as a normal file URI, “the page actually accepted this URI as valid and reloaded the same content. Which means I just changed the document.domain using this really dumb trick. (CVE-2020-3885).”

So now the Safari browser thinks the website connected is skype9.0com, by opening the local file attackers can run a malicious script and gain access to Camera, Microphone, and Screen Sharing.

He found another bug (CVE-2020-9784 & CVE-2020-3887) to bypass the auto-download prevention in the Safari browser.

By using blob://skype.com URI a popup can be triggered and can be used to execute the arbitrary JavaScript.

Trying all chain of bugs can grant access to iOS/macOS camera, microphone, or location, and in some cases, saved passwords.

Following are the seven bugs

CVE-2020-3852 – A logic issue was addressed with improved validation.

CVE-2020-3864 – A DOM object context may not have had a unique security origin

CVE-2020-3865 – A top-level DOM object context may have incorrectly been considered secure

CVE-2020-3885 – File URL processed incorrectly.

CVE-2020-3887 – A download’s origin may be incorrectly associated

CVE-2020-9784 – Malicious iframe use another website’s download settings

CVE-2020-9787 – Hostnames with a dash (-) and period (.) are ignored

iOS/macOS Webcam

All the vulnerabilities patched in January and March updates. The researcher receives $75,000 for the bug submission.


Latest articles

Hacker Customize LockBit 3.0 Ransomware to Attack Orgs Worldwide

Cybersecurity researchers at Kaspersky have uncovered evidence that cybercriminal groups are customizing the virulent...

Microsoft .NET, .NET Framework, & Visual Studio Vulnerable To RCE Attacks

A new remote code execution vulnerability has been identified to be affecting multiple Microsoft...

LightSpy Hackers Indian Apple Device Users to Steal Sensitive Data

The revival of the LightSpy malware campaign has been observed, focusing on Indian Apple...

LightSpy Malware Attacking Android and iOS Users

A new malware known as LightSpy has been targeting Android and iOS users.This sophisticated...

This Startup Aims To Simplify End-to-End Cybersecurity, So Anyone Can Do It

The Web3 movement is going from strength to strength with every day that passes....

Alert! Palo Alto RCE Zero-day Vulnerability Actively Exploited in the Wild

In a recent security bulletin, Palo Alto Networks disclosed a critical vulnerability in its...

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles