Apple Pays $100,500 Bounty to Hacker Who Found Way to Hack MacBook Webcam

Apple last year fixed a new set of macOS vulnerabilities that
exposed Safari browser to attack, potentially allowing malicious
actors to access users’ online accounts, microphone, and
webcam.

Security researcher Ryan Pickren, who discovered and reported
the bugs to the iPhone maker, was compensated with a $100,500 bug
bounty, underscoring the severity of the issues.

By exploiting a chain of security issues with iCloud Sharing and
Safari 15, it enables the attacker to hijack the multimedia
permission and gain “full access to every website ever visited by
the victim” in Safari, including Gmail, iCloud, Facebook, and
PayPal accounts.

The issues^[1]
specifically concern ShareBear, an iCloud file-sharing mechanism
that prompts users upon attempting to open a shared document for
the first time. Taking advantage of the fact that users are never
displayed the prompt again once they accept to open the file,
Pickren found that it’s possible to alter the file’s content to
anything by anyone with access to the file.

“ShareBear will then download and update the file on the
victim’s machine without any user interaction or notification,”
Pickren explained^[2]
in a technical write-up. “In essence, the victim has given the
attacker permission to plant a polymorphic file onto their machine
and the permission to remotely launch it at any moment.”

In other words, an image file with a .PNG format could have its
entire content and extension changed to an executable binary
(“evil.dmg”) after the user has agreed to open it. The binary can
then be launched, triggering an exploit chain that leverages
additional flaws discovered in Safari to take over the machine’s
mic or webcam, or even steal local files —

• CVE-2021-30861^[3]
  – A logic issue in WebKit that could allow a malicious application
  to bypass Gatekeeper checks
• CVE-2021-30975^[4]
  – An issue in Script Editor that could allow a malicious OSAX scripting addition^[5]
  to bypass Gatekeeper checks and circumvent sandbox
  restrictions

This is the second time^[6]
Pickren has disclosed flaws in iOS and macOS that, if successfully
exploited, could be abused to access the camera in an unauthorized
manner upon visiting a specially crafted website.

“This project was an interesting exploration of how a design
flaw in one application can enable a variety of other, unrelated,
bugs to become more dangerous,” Pickren said. “It was also a great
example of how even with macOS Gatekeeper enabled, an attacker can
still achieve a lot of mischief by tricking approved apps into
doing malicious things.”