Microsoft Exposes macOS Vulnerability in Safari: The HM Surf

Microsoft has recently disclosed a newly identified vulnerability in Apple’s macOS that raises serious concerns about user privacy. This flaw, tracked as CVE-2024-44133 and codenamed HM Surf, affects Apple’s Transparency, Consent, and Control (TCC) framework, which is designed to protect user data. The vulnerability allows malicious actors to bypass these privacy controls and access sensitive user information without consent.

Understanding the TCC Framework

Apple’s TCC framework serves as a vital security mechanism, ensuring that applications cannot access sensitive user data—like location services, camera, and microphone—without explicit permission. This system is meant to safeguard users from unwanted surveillance and data collection. However, the HM Surf vulnerability undermines this framework by enabling attackers to modify certain configuration files associated with the Safari browser, effectively allowing unauthorized access to user data.

The Mechanics of HM Surf

According to Jonathan Bar Or from Microsoft’s Threat Intelligence team, the exploit works by removing TCC protection specifically for the Safari browser directory. The attacker can alter a configuration file within this directory to gain access to various types of user data, including:

• Browsed pages
• Camera and microphone inputs
• Geolocation data

The steps involved in executing the HM Surf exploit are relatively straightforward:

1. Changing the User’s Home Directory: The attacker uses the dscl utility to change the current user’s home directory, a step that bypasses TCC access restrictions in macOS Sonoma.

2. Modifying Sensitive Files: The next step involves altering sensitive files, such as PerSitePreferences.db, located in the “~/Library/Safari” directory under the real home directory of the user.

3. Reverting the Home Directory: Once the modifications are made, the attacker changes the home directory back to its original setting, prompting Safari to utilize the altered files.

4. Launching Safari: Finally, the attacker can open a web page that prompts the user for camera access or location, potentially capturing images or audio without consent.

This exploit could further be extended to record an entire camera stream or covertly capture audio via the Mac’s microphone.

The Impact of the Vulnerability

The implications of this vulnerability are alarming, especially as Microsoft has linked it to suspicious activities associated with a known macOS adware threat called AdLoad. While Microsoft could not conclusively determine whether the AdLoad campaign was directly exploiting the HM Surf vulnerability, the potential for similar techniques being employed by attackers underscores the need for heightened security measures.

Apple’s Response

In response to the identification of HM Surf, Apple promptly addressed the vulnerability in macOS Sequoia 15 by removing the vulnerable code. However, Microsoft has cautioned users that protections are currently limited to the Safari browser. The tech giant is actively collaborating with other major browser vendors to explore ways to strengthen local configuration files further.