{"id":4935,"date":"2024-08-19T16:22:25","date_gmt":"2024-08-19T21:22:25","guid":{"rendered":"https:\/\/www.darkreading.com\/remote-workforce\/multiple-microsoft-apps-for-macos-vuln-to-malicious-library-injection-attacks"},"modified":"2024-08-19T16:22:25","modified_gmt":"2024-08-19T21:22:25","slug":"multiple-microsoft-apps-for-macos-vulnerable-to-library-injection-attacks","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/08\/19\/multiple-microsoft-apps-for-macos-vulnerable-to-library-injection-attacks\/","title":{"rendered":"Multiple Microsoft Apps for macOS Vulnerable to Library Injection Attacks"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

Widely used Microsoft apps for macOS are vulnerable to library injection attacks that let adversaries use the applications’ entitlements to bypass macOS’s strict permission-based security model and controls.<\/span><\/p>\n

Attackers can abuse the vulnerable apps to execute a variety of malicious actions \u2014 like surreptitiously sending emails from a user’s account or recording audio and video clips \u2014 without the user’s knowledge and without the need for any user interaction.<\/span><\/p>\n

Researchers from Cisco Talos recently <\/span>discovered the issues<\/a><\/span> when researching the exploitability of Apple’s Transparency, Consent and Control (<\/span>TCC<\/a><\/span>) framework for managing and enforcing privacy settings on user data and various system services on macOS systems. One of TCC’s core functions is controlling an application’s access to sensitive user data and to system features like the camera, microphone, contacts, calendars, and location services.<\/span><\/p>\n

Vulnerable Apps<\/h2>\n

Cisco Talos researchers found eight major Microsoft apps for macOS \u2014 Outlook, Teams, PowerPoint, OneNote, Excel, Word, and two other Teams-related components \u2014 allow attackers to inject a malicious library into the app’s running processes. “That library could use all the permissions already granted to the process, effectively operating on behalf of the application itself,” Cisco Talos said in a report this week.<\/span><\/p>\n

The issue identified by Cisco Talos has to do with Microsoft’s decision to disable a library validation feature in the apps so as to allow the loading of third-party plug-ins. “Permissions regulate whether an app can access resources such as the microphone, camera, folders, screen recording, user input, and more. So, if an adversary were to gain access to these, they could potentially leak sensitive information or, in the worst case, escalate privileges,” the researchers said.<\/span><\/p>\n

Cisco Talos has issued eight separate CVEs for the disabled library validation issue across the eight Microsoft apps for macOS.<\/span><\/p>\n

Microsoft did not immediately respond to a Dark Reading request for comment. However, according to Cisco Talos, Microsoft has characterized the issue as a low-severity threat and has said it will not issue any fix for them. Even so, Microsoft does appear to have updated the affected Teams and OneNote apps after being notified of the problem, Cisco Talos said. But four Microsoft apps for macOS \u2014 Excel, Outlook, PowerPoint, and Word remain vulnerable \u2014 the security vendor said.<\/span><\/p>\n

Apple’s TCC Undermined<\/h2>\n

Jason Soroko, senior vice president of product at Sectigo, says Microsoft’s decision to classify the issue as low-severity and opt not to issue a fix is potentially risky. “This approach overlooks the harm if attackers exploit these vulnerabilities to gain unauthorized access to sensitive device features like the camera or microphone,” Soroko says. “By downplaying the threat, Microsoft risks underestimating the <\/span>ingenuity of attackers<\/a><\/span> who could weaponize even ‘low severity’ flaws in <\/span>creative and damaging ways<\/a><\/span>.”<\/span><\/p>\n

Cisco Talos itself has described the Microsoft apps as undermining the security and privacy protection of Apple’s TCC framework. Unlike most other operating systems that rely by default on what is known as Discretionary Access Control, TCC goes a step further in requiring apps to obtain explicit user permission when seeking to access certain content and services such as contacts, calendars, photos, and access to the microphone and camera. TCC also supports a feature that protects specifically against code and library injection into an application’s running processes.<\/span><\/p>\n

By disabling library validation, Microsoft has essentially given an opening for attackers to do an end run around the protections and sneak an arbitrary library into the app’s running processes, Cisco Talos said.<\/span><\/p>\n

Soroko says the ease of exploiting this issue varies. “While library injection attacks require technical skill, the fact that these vulnerabilities exist in widely used applications like Teams and Outlook increases the risk profile. An attacker with sufficient knowledge could exploit these flaws, particularly in environments with relaxed security practices.”<\/span><\/p>\n

He recommends that organizations review and tighten app permissions and implement monitoring for unusual activity.<\/span><\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Widely used Microsoft apps for macOS are vulnerable to library<\/p>\n","protected":false},"author":12,"featured_media":4936,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[809],"class_list":["post-4935","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-dark-reading"],"featured_image_urls":{"full":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/multiple-microsoft-apps-for-macos-vulnerable-to-library-injection-attacks.jpg?fit=1920%2C1080&ssl=1",1920,1080,false],"thumbnail":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/multiple-microsoft-apps-for-macos-vulnerable-to-library-injection-attacks.jpg?resize=150%2C150&ssl=1",150,150,true],"medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/multiple-microsoft-apps-for-macos-vulnerable-to-library-injection-attacks.jpg?fit=300%2C169&ssl=1",300,169,true],"medium_large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/multiple-microsoft-apps-for-macos-vulnerable-to-library-injection-attacks.jpg?fit=640%2C360&ssl=1",640,360,true],"large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/multiple-microsoft-apps-for-macos-vulnerable-to-library-injection-attacks.jpg?fit=640%2C360&ssl=1",640,360,true],"1536x1536":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/multiple-microsoft-apps-for-macos-vulnerable-to-library-injection-attacks.jpg?fit=1536%2C864&ssl=1",1536,864,true],"2048x2048":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/multiple-microsoft-apps-for-macos-vulnerable-to-library-injection-attacks.jpg?fit=1920%2C1080&ssl=1",1920,1080,true],"chromenews-featured":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/multiple-microsoft-apps-for-macos-vulnerable-to-library-injection-attacks.jpg?fit=1024%2C576&ssl=1",1024,576,true],"chromenews-large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/multiple-microsoft-apps-for-macos-vulnerable-to-library-injection-attacks.jpg?resize=825%2C575&ssl=1",825,575,true],"chromenews-medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/multiple-microsoft-apps-for-macos-vulnerable-to-library-injection-attacks.jpg?resize=590%2C410&ssl=1",590,410,true]},"author_info":{"display_name":"Dark Reading","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/darkreading\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","jetpack_featured_media_url":"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/multiple-microsoft-apps-for-macos-vulnerable-to-library-injection-attacks.jpg?fit=1920%2C1080&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/4935","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=4935"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/4935\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media\/4936"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=4935"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=4935"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=4935"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}