Codenamed “HM Surf” and tracked as CVE-2024-44133, Microsoft uncovers critical macOS vulnerability in Safari browser

Microsoft‘s Threat Intelligence team has revealed details about a recently patched security flaw in Apple’s macOS operating system. The vulnerability, codenamed “HM Surf” and tracked as CVE-2024-44133, allowed unauthorized access to sensitive user data by bypassing privacy controls in the Safari browser.

The vulnerability explained

The HM Surf vulnerability specifically targeted Apple’s Transparency, Consent, and Control (TCC) framework in macOS. This framework is designed to protect user privacy by managing how apps access sensitive data and system resources. However, the flaw allowed attackers to circumvent these protections, potentially exposing users to significant privacy breaches.

Jonathan Bar Or of the Microsoft Threat Intelligence team explained, “The vulnerability, which we refer to as ‘HM Surf’, involves removing the TCC protection for the Safari browser directory and modifying a configuration file in the said directory to gain access to the user’s data, including browsed pages, the device’s camera, microphone, and location, without the user’s consent.”

HM Surf CVE-2024-44133 exploitation

The exploitation of HM Surf (CVE-2024-44133) could allow malicious actors to access:

1. Browsing history
2. Camera footage
3. Microphone recordings
4. Device location data

All of this could be achieved without the user’s knowledge or consent, making it a particularly dangerous vulnerability.

Microsoft researchers demonstrated that the exploit could be extended to save entire camera streams or stealthily capture audio through the Mac’s microphone. This level of access could have severe implications for user privacy and security.

Apple’s response and patch

Apple addressed the vulnerability with the release of macOS Sequoia 15 in September 2024. The patch removed the vulnerable code, effectively closing the security gap. However, users who have not yet updated their systems remain at risk.

Potential exploitation in the wild

In a concerning development, Microsoft noted that it had observed suspicious activity associated with a known macOS adware threat named AdLoad, which was likely exploiting the HM Surf vulnerability. While the exact nature of this exploitation couldn’t be fully determined, it raises significant concerns about the vulnerability’s potential impact before it was patched.

“Since we weren’t able to observe the steps taken leading to the activity, we can’t fully determine if the AdLoad campaign is exploiting the HM surf vulnerability itself. Attackers using a similar method to deploy a prevalent threat raises the importance of having protection against attacks using this technique,” Bar Or stated.

This discovery highlights the ongoing challenges in maintaining privacy and security in modern operating systems. It also underscores the importance of cross-industry collaboration in identifying and addressing vulnerabilities.

Microsoft’s discovery of this flaw in a competitor’s product demonstrates the company’s commitment to improving cybersecurity across all platforms. This approach benefits the entire tech ecosystem and ultimately protects users regardless of their chosen devices or operating systems.

Recommendations for users

In light of this vulnerability, cybersecurity experts recommend the following actions:

1. Update to macOS Sequoia 15 or later immediately
2. Enable automatic updates to ensure timely installation of security patches
3. Use endpoint protection solutions capable of detecting HM Surf exploitation attempts
4. Consider using alternative browsers that are not vulnerable to this specific exploit

The HM Surf vulnerability serves as a stark reminder of the constant threats to digital privacy and security. While Apple has addressed this particular issue, it emphasizes the need for ongoing vigilance, regular software updates, and robust security measures to protect sensitive user data.

As the digital landscape continues to evolve, collaboration between tech giants like Microsoft and Apple in identifying and addressing vulnerabilities will be crucial in maintaining a secure computing environment for all users.