Apple

Tech giant Apple released a patch for two zero-day vulnerabilities that hackers had used to exploit Intel-based Mac computers.
According to a Nov. 19 <a data-ct-non-breakable="null" href="https://support.apple.com/en-us/121753" rel="null" target="null" text="null" title="null">advisory</a> from Apple, both vulnerabilities had been “actively exploited” and involved “processing maliciously crafted web content.”&nbsp;
The vulnerabilities even caught the attention of the co-founder and former CEO of Binance, <a data-ct-non-breakable="null" href="https://cointelegraph.com/learn/articles/changpeng-zhao-ceo-of-binance" rel="null" target="null" text="null" title="null">Changpeng “CZ” Zhao</a>, who chimed in, warning users to update their tech immediately to avoid falling <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/what-is-crypto-malware-and-how-to-detect-it" rel="null" target="null" text="null" title="null">prey to the exploit</a>.&nbsp;
“If you use a Macbook with Intel based chip, update asap!” he said.
<figure>
 <img alt="Apple, Changpeng Zhao, Hackers, Hacks" src="https://s3.cointelegraph.com/uploads/2024-11/01934c61-dd8a-77c5-b08f-5d9c24cdc519" title="">
 <figcaption style="text-align: center;">
 Source: <a data-ct-non-breakable="null" href="https://x.com/cz_binance/status/1859287351757078958" rel="null" target="null" text="null" title="null">Changpeng Zhao</a>
 </figcaption>
</figure>
One of the flaws, tagged as CVE-2024-44308 by Apple, can trigger JavaScriptCore software to run malicious code without a user’s knowledge or permission. Apple said the issue was “addressed with improved checks.”
The second vulnerability, CVE-2024-44309, can cause a “cross-site scripting attack” through Apple’s WebKit browser engine. A cyberattack of this nature can result in hackers injecting malicious computer code into other websites or apps being used.
Apple said this was “a cookie management issue” and was addressed with “improved state management.”
As is often the case, the tech giant didn’t “disclose, discuss, or confirm” the flaws until it had investigated and crafted a patch to fix them.
A zero-day flaw is a bug or weakness that hackers discover and take advantage of before the software developer can patch or address the issue, giving them “zero days” to fix it.
Further details are scarce. It’s unknown who is behind the hack, how many users have been affected or if any cyberattacks were successful.
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/traumatic-apple-id-hack-shows-pitfalls-centralized-identity" rel="null" target="null" text="null" title="null">My traumatic Apple ID hack showed pitfalls of centralized identity</a>
The tech giant listed Google security researchers Clément Lecigne and Benoît Sevens as the ones who found the bugs.
Both are from the company’s Threat Analysis Group, which focuses on countering government-backed hacking and attacks against Google, which could suggest the culprit, in this case, is an unfriendly government.
North Korea targeted Apple users earlier this month. On Nov. 12, <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/north-korean-malware-bypasses-apple-security" rel="null" target="null" text="null" title="null">researchers caught North Korean hackers </a>going after macOS users with a new malware campaign using<a data-ct-non-breakable="null" href="https://cointelegraph.com/learn/articles/what-is-a-phishing-attack-in-crypto-and-how-to-prevent-it" rel="null" target="null" text="null" title="null"> phishing emails</a>, fake PDF applications and a technique to evade Apple’s security checks.&nbsp;
The researchers said it was the first time they had seen this type of tech used to compromise Apple’s macOS operating system, but they found it couldn’t run on up-to-date systems.
In October, North Korean hackers were also<a data-ct-non-breakable="null" href="https://cointelegraph.com/news/north-korean-lazarus-group-chrome-zero-day-nft-game-hack" rel="null" target="null" text="null" title="null"> caught exploiting a vulnerability</a> in Google’s Chrome to steal crypto wallet credentials.&nbsp;
Magazine: <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/crypto-four-years-grow-cant-be-shut-down-kain-warwick-infinex/" rel="null" target="null" text="null" title="null">Crypto has 4 years to grow so big ‘no one can shut it down’: Kain Warwick, Infinex</a>

Apple rushes out patch fixing zero-day attacks on macOS systems

Cointelegraph

Other articles published on Nov 21, 2024

XRP Price Spikes As SEC Chair Gensler Officially Announces Resignation Date

Bitcoin Price Hits $97.5k: Here’s Why $100K Could Be Next as Whales and Sharks Accumulate

A Singaporean man’s alleged US$230 million crypto theft

Dogecoin Whales Accumulate Significant Holdings, Indicating Market Potential

Boost Your Portfolio With XYZ and 3 Altcoins: A 250x Opportunity You Can’t Ignore

Renewed Interest in Ethereum dApps Could Drive ETH Price Above $3,200

Join our free newsletter for daily crypto updates!