Microsoft's macOS apps have security flaws that allow spying
Cisco Talos, a renowned cybersecurity firm, has recently discovered multiple security flaws in several Microsoft applications designed for macOS. These vulnerabilities could potentially enable attackers to spy on users by gaining unauthorized access to their cameras and other system components. The affected apps include widely used programs like Word, Outlook, Excel, OneNote, and Teams.
Vulnerabilities allow injection of malicious code
The security vulnerabilities identified in Microsoft's macOS apps could allow attackers to feed malicious code into these programs. This is possible due to the exploitation of permissions and entitlements granted by users. For example, an attacker could gain access to the microphone or camera, record audio or video content, and steal sensitive information without the user being aware.
Impact of vulnerabilities varies by application
The potential impact of these security flaws can vary depending on the specific Microsoft app and its granted permissions. For instance, an attacker could exploit Microsoft Teams to record professional conversations or access confidential data. Similarly, unauthorized emails could be sent via Outlook, potentially leading to data breaches.
Microsoft acknowledges vulnerabilities but deems them low risk
Microsoft has acknowledged the vulnerabilities identified by Cisco Talos, but considers them to be of low risk. The company has already taken steps to address some of these issues by modifying certain apps like Teams and OneNote, as well as Teams helper apps. However, other popular programs such as Word, Excel, Outlook, and PowerPoint continue to use a feature that makes them susceptible to attacks.
Microsoft declines to fix issues in some apps
Despite the identified vulnerabilities, Microsoft has reportedly "declined to fix the issues" in certain apps, as reported by Apple Insider. The company justifies this decision by stating that these apps "need to allow loading of unsigned libraries to support plugins." This implies that users of Word, Excel, Outlook, and PowerPoint on macOS may remain vulnerable to potential security breaches.
