Vulnerabilities in macOS Catches CZ's Attention
Apple has issued a critical patch addressing two zero-day vulnerabilities actively exploited by hackers targeting Intel-based Mac computers.
⚠️ URGENT ALERT!
Apple confirms active zero-day vulnerabilities targeting Intel-based macOS systems. Your data could be at risk—Update NOW! #zerodayflaws #AppleSecurity #macosupdate #cybersecurityalert #VPNRanks #TechNewsUpdate pic.twitter.com/nb75wLCPo4
— VPNRanks (@VPNRanks) November 20, 2024
According to Apple's 19 November advisory, these flaws involve the processing of maliciously crafted web content, posing significant risks to users.
The urgency of the update drew attention from Changpeng Zhao (CZ), Binance's co-founder and former CEO, who urged users to act immediately by updating their systems to mitigate potential exposure to these exploits.
If you use a Macbook with Intel based chip, update asap!
Stay SAFU!https://t.co/mk2Jsicnte
— CZ 🔶 BNB (@cz_binance) November 20, 2024
He later pointed out on X (formerly known as Twitter) that updating the phones is an important security fix.
Also update your iPhones. Important security fix.https://t.co/rPKZzp41Ut https://t.co/29s0Wsj8cQ
— CZ 🔶 BNB (@cz_binance) November 21, 2024
Apple Rushes to Fix Exploit, Details Still Scarce
Apple has identified and patched two critical vulnerabilities actively exploited in the wild, labelled CVE-2024-44308 and CVE-2024-44309.
The first flaw, found in JavaScriptCore, allowed malicious code execution without user consent.
Apple resolved this issue by implementing improved validation checks.
The second vulnerability, rooted in the WebKit browser engine, enabled cross-site scripting attacks, allowing hackers to inject malicious code into websites or applications.
Apple just fixed two 0-days, in JavaScript and WebKit.
Settings > General > Software Update to check if you have the patch.
One is cross-site scripting (“give rogue content a trusted URL”). The other is remote code execution (“run malware covertly”) pic.twitter.com/905S0aDtCG
— Paul Ducklin (@duckblog) November 19, 2024
Apple attributed the flaw to a cookie management issue, which it addressed through enhanced state management.
As is standard practice, Apple withheld public disclosure of the vulnerabilities until thorough investigations were completed and patches deployed.
These zero-day exploits—named for the lack of time developers have to respond before exploitation begins—highlight the ongoing challenges of cybersecurity.
Details remain limited, with no confirmed information about the attackers, affected users, or the success rate of the attacks.
Apple was Just Recently Targeted
Google security researchers Clément Lecigne and Benoît Sevens, from the Threat Analysis Group, were credited with discovering the vulnerabilities in Apple's systems.
This group is known for countering government-backed cyberattacks, which raises suspicions that the source of this latest exploit may be a state actor, potentially one hostile to the tech giant.
Earlier this month, North Korea was implicated in targeting Apple users, with researchers uncovering a new malware campaign aimed at macOS users.
The attack employed phishing emails, fake PDF applications, and sophisticated methods to bypass Apple's security measures.
Notably, this marked the first instance of such a technique being used to compromise macOS, though it was unable to affect up-to-date systems.
In a related incident, North Korean hackers were also found exploiting a vulnerability in Google Chrome in October to steal cryptocurrency wallet credentials.
