How Just Opening A Site In Safari Could Have Hacked Your Apple macOS

The reported vulnerabilities were originally discovered by
Syndis, a cybersecurity firm hired by Dropbox to conduct
simulated penetration testing attacks as Red Team on the company’s
IT infrastructure, including Apple software used by
Dropbox.

The vulnerabilities were discovered and disclosed to Apple security
team in February this year, which were then patched by Apple just
over one month later with the release of its March security
updates^[1]. DropBox applauded Apple
for its quick response to its bug report.

According to DropBox, the vulnerabilities discovered by Syndis
didn’t just affect its macOS fleet, but also affected all Safari
users running the latest version of the web browser and operating
system at the time.

Here’s the list of the three reported (then-zero-day)
vulnerabilities:

1. The first flaw (CVE-2017-13890) that resided in
   CoreTypes component of macOS allowed Safari web browser to
   automatically download and mount a disk image on visitors’ system
   through a maliciously crafted web page.
2. The second flaw (CVE-2018-4176) resided in the way Disk
   Images handled .bundle files, which are applications packaged as
   directories. Exploiting the flaw could have allowed an attacker to
   launch a malicious application from mounted disk using a bootable
   volume utility called bless and its –openfolder argument.
3. The third vulnerability (CVE-2018-4175) involved a
   bypass of macOS Gatekeeper anti-malware, allowing a maliciously
   crafted application to bypass code signing enforcement and execute
   a modified version of Terminal app leading to arbitrary commands
   execution.

As shown in the proof-of-concept video demonstration, the
researchers were able to create a two-stage attack by chaining
together all the three vulnerabilities to take control of a Mac
computer just by convincing a victim into visiting a malicious web
page with Safari.