A newly disclosed flaw lets attackers hijack fully updated Macs simply by putting certain kinds of URLs in an email attachment.
The flaw, reported earlier by Bleeping Computer, abuses the handling of "inetloc" files, a Mac file format that contains a link to an internet location such as a website or other server.
- Thousands of Netgear routers can be hacked — here's what to do
- The best Mac antivirus software
- Plus: iPhone 13 Pro review: One of the best phones ever
Independent security researcher Park Minchan found that prefacing a link in an inetloc file with "file://" instead of "http://" or "https://" made it possible to run arbitrary code on — i.e. hack — any Mac running fully updated macOS 11.6 Big Sur. (The "file://" prefix specifies a file on the local PC.)
"These files can be embedded inside emails which, if the user clicks on them, will execute the commands embedded inside them without providing a prompt or warning to the user," said an unsigned posting today (Sept. 21) on the SSD-Disclosure bug-reporting website.
Apple did apparently patch the flaw so that "file://" can no longer be abused using this flaw. However, Park found that switching up the letter cases so that the prefix read "File://" or "fIle://" still worked. (URLs are generally case-insensitive, so "hTTpS://tomsGUIde.coM" will work just as well as "https://tomsguide.com".)
This might look like a zero-day flaw, yet it's more like a flaw that Apple knew about but didn't properly patch. Tom's Guide has sent an email to Apple seeking comment but hasn't yet received a response.
"We have notified Apple that FiLe:// (just mangling the value) doesn't appear to be blocked, but have not received any response from them since the report has been made," said the SSD-Disclosure posting. "As far as we know, at the moment, the vulnerability has not been patched."
How you can avoid this
Bleeping Computer tried out the eight-line proof-of-concept exploit provided at the end of the posting and confirmed that it did indeed work on macOS Big Sur. Tom's Guide has not had a chance to try out the exploit.
For now, the only way to avoid this kind of attack is to not open email attachments you don't expect. As of this writing, none of the antivirus malware-detection engines on VirusTotal flagged the proof-of-concept code as malicious.
