https://www.forbes.com/sites/thomasbrewster/2021/05/24/update-your-mac-now-nasty-hack-breaks-apple-security-to-take-sneaky-photos/ Explore * Billionaires + All Billionaires + World's Billionaires + Forbes 400 + America's Richest Self-Made Women + China's Richest + India's Richest + Indonesia's Richest + Korea's Richest + Thailand's Richest + Japan's Richest + Australia's Richest + Taiwan's Richest + Singapore's Richest + Philippines' Richest + Hong Kong's Richest + Malaysia's Richest + Money & Politics + 2020 Money * Innovation + All Innovation + 5G + AI + Big Data + Cloud + Cloud 100 + Cognizant BrandVoice | Paid Program + Consumer Tech + Cybersecurity + Enterprise Tech + Future Of Work + Games + Health + Innovation Rules + Jumio BrandVoice | Paid Program + SAP BrandVoice | Paid Program + Science + ServiceNow BrandVoice | Paid Program + Social Media + SurveyMonkey BrandVoice | Paid Program + Sustainability + T-Mobile for Business BrandVoice | Paid Program + Venture Capital + Wind River BrandVoice | Paid Program * Leadership + All Leadership + Careers + CEO Network + CFO Network + CIO Network + CMO Network + CxO + Deloitte BrandVoice | Paid Program + Diversity, Equity & Inclusion + Education + Forbes EQ | Paid Program + Forbes The Culture + ForbesWomen + Google Cloud BrandVoice | Paid Program + Leadership Strategy + Splunk BrandVoice | Paid Program + Under 30 + Working Remote + Over 50 * Money + All Money + Banking & Insurance + Crypto & Blockchain + ETFs & Mutual Funds + Fintech + Hedge Funds & Private Equity + Investing + Markets + Personal Finance + Premium Investing Newsletters + Retirement + Taxes + Top Advisor | SHOOK + Wealth Management + Election 2020 * Business + All Business + Aerospace & Defense + Alteryx BrandVoice | Paid Program + Energy + Food & Drink + Hollywood & Entertainment + Honeywell BrandVoice | Paid Program + Manufacturing + Media + Policy + Retail + Ryder BrandVoice | Paid Program + SportsMoney + Tableau BrandVoice | Paid Program + Transportation * Small Business + All Small Business + Entrepreneurs + Franchises + Office Depot OfficeMax BrandVoice | Paid Program + Small Business Strategy + Square BrandVoice | Paid Program * Lifestyle + All Lifestyle + Arts + Boats & Planes + Cars & Bikes + Dining + ForbesLife + Forbes Travel Guide + Spirits + Style & Beauty + Travel + Vices + Watches * Real Estate + All Real Estate + Commercial Real Estate + Forbes Global Properties + Residential Real Estate * Vetted + All Vetted + Gear + Health & Wellness + Home & Kitchen + Style + Tech & Electronics * Coupons + All Coupons + Purple + Squarespace + Verizon + Lululemon + AT&T + Lowe's + Brooks Brothers + Tory Burch + Dr Martens + Dell + Chewy * Advisor + All Advisor + Life Insurance + Best Life Insurance Companies + Best Term Life Insurance + The Best Credit Cards Of 2021 + Best Balance Transfer Credit Cards + Best Cash Back Credit Cards + Best 0% APR Credit Cards + Best Travel Credit Cards + Best Business Credit Cards + Best Travel Insurance Companies + Pandemic Travel Insurance + Best Car Insurance Companies + Best Pet Insurance + Best Personal Loans + Best Student Loans + Best Student Loan Refinance + Best Tax Software For 2021 + Best Project Management Software + Forbes Advisor UK * Wheels + All Wheels + Best Sedans + Best Luxury SUVs + Best SUVs + Best Pickups + Best Performance Cars + Best Family-Friendly Sedans + Best SUVs & Crossovers + Best Electric Cars + Best Sports Cars * Lists + All Lists * Video + All Video * Newsletters + Crypto Confidential + Editorial Newsletters + Investing Digest + Premium Investing Newsletters * Forbes Magazine + All Forbes Magazine + Forbes Asia + Free Issue of Forbes * Latest + Coronavirus Coverage + Daily Cover Stories + Dark Capital + Editors' Picks + Election 2020 + Visual Web Stories * Featured + 30 Under 30 2021 + All Hands On Data - A Tableau Series | Paid Program + America's Top Women Wealth Advisors + Atlassian BrandVoice | Paid Program + Capital One BrandVoice | Paid Program + Data Sharing In The Covid Era | Paid Program + DNA Of Success + Emotional EQuity | Paid Program + Forbes Next 1000 2021 + Future of Work | Presented by Microsoft Teams + Hitachi ABB Power Grids BrandVoice | Paid Program + SAP Concur BrandVoice | Paid Program + Schneider Electric BrandVoice | Paid Program + ServiceNow BrandVoice | Paid Program + Square BrandVoice | Paid Program + TD Bank BrandVoice | Paid Program + The Next Step | Small Business Video Series + World's Billionaires List * Advertise with Forbes * Report a Security Issue * Site Feedback * Contact Us * Careers at Forbes * Tips * Corrections * Privacy * Do Not Sell My Info * Terms * AdChoices * Reprints & Permissions (c) 2021 Forbes Media LLC. All Rights Reserved Sign In Subscribe BETA This is a BETA experience. You may opt-out by clicking here More From Forbes May 24, 2021,02:58pm EDT iOS 14.6: Apple Issues Update Now Warning To All iPhone Users May 22, 2021,11:50am EDT Why You Should Stop Using Google Chrome On Your iPhone, iPad And Mac May 22, 2021,11:50am EDT Facebook Still 'Secretly' Tracks Your iPhone--This Is How To Stop It May 22, 2021,09:00am EDT App Store Scandal: What iPhone And Android Users Need To Do Right Now May 22, 2021,09:00am EDT Apple AirTags: What All iPhone Users Should Know May 21, 2021,06:30am EDT Amazon, Uber And America's Biggest Delivery Companies All Fell For Basic 'Fake Driver' Scam May 21, 2021,06:03am EDT Apple Issues New Blow To Facebook With Stunning iPhone Privacy Move Edit Story Editors' Pick|May 24, 2021,03:00pm EDT| Update Your Mac Now: Nasty Hack Breaks Apple Security To Take Sneaky Photos Thomas Brewster Thomas Brewster Forbes Staff Cybersecurity Associate editor at Forbes, covering cybercrime, privacy, security and surveillance. * Share to Facebook * Share to Twitter * Share to Linkedin Apple Macs under attack Apple Mac users have been advised to update their macOS today as hackers have been exploiting ... [+] another vulnerability in the operating system, one that could lead to surreptitious snaps via people's webcams or sneaky recordings through the microphone. (Photo Illustration by Rafael Henrique/SOPA Images/LightRocket via Getty Images) SOPA Images/LightRocket via Getty Images It's time to update your Apple Mac again, as malware that secretly takes screenshots has been spotted exploiting a serious weakness in macOS security. The flaw could be abused to record video or access files on Macs too, making patching more urgent. The discovery was made by cybersecurity company Jamf during research into the XCSSET malware, first discovered in 2020. The hackers who created the spyware discovered they could get around a macOS privacy feature known as Transparency Consent and Control. The TCC is the feature that raises a flag when an app is doing something that might affect users' privacy, such as taking photos or recording keystrokes, asking for explicit permission from the user before any action is taken. The malware coders found a way to hijack other apps' permissions, ones that have already been approved by the user. For instance, according to Jamf, the malware could create an app within Zoom, the hugely popular videoconferencing app, that would secretly record what's happening on the screen. Because the malicious app effectively hooked into Zoom, which already had permission to carry out the screen recording, no prompt warning about the action would land on the Mac users' screen, according to Jamf. Thus far the hackers have only been seen abusing the flaw to take screenshots, but the same exploit could be abused to pilfer files, record audio over the microphone or take images via the Mac's camera, Jamf said. The weakness has been addressed in the latest version of macOS, Big Sur 11.4, released on Monday, Apple confirmed to Forbes. Malware should no longer be able to abuse permissions of other apps as before. Apple also stressed that the issue only affected users who downloaded and ran the malware, and macOS didn't block it. The company spokesperson added that the safest place to download software was the Apple Mac App Store. MORE FOR YOU Why You Should Stop Using Google Chrome On Your iPhone, iPad And Mac Facebook Still 'Secretly' Tracks Your iPhone--This Is How To Stop It Has WhatsApp Secretly Changed Your Privacy Settings? What's motivating mysterious Apple Mac hackers? Jaron Bradley, a Mac expert at cybersecurity company Jamf, told Forbes it isn't yet clear what is motivating the XCSSET hackers. Last August, the malware was seen exploiting unpatched vulnerabilities in macOS via its XCode development platform. Just this April, it was revealed the malware coders had adapted their tools to work on the latest Apple Macs, including the M1 devices. "Their backdoor is built with a number of different capabilities, some that are designed to spy on the user, some that focus on the theft of personal files and some that focus on ransomware functionality. It seems they have a variety of interests for the victim systems," Bradley added. Whilst the malware isn't particularly widespread - just under 400 at the last count by cybersecurity firm Trend Micro - it has highlighted another potentially-severe weakness in Apple's desktop operating system. The news lands a matter of weeks after Apple issued a patch to deal with another macOS weakness, exploited by malware dubbed Shlayer, which was able to slip past checks by Gatekeeper and File Quarantine, which are designed to stop any unapproved, malicious apps from running. Just last week, Craig Federighi, Apple's senior vice president of software engineering, admitted that Macs had a serious malware problem. "Today we have a level of malware on the Mac that we don't find acceptable," Federighi told a court during Apple's legal battle with games maker Epic, according to a Bloomberg report. In comparing Mac with iPhone security, Federighi said the ability to install software on Macs that isn't vetted by Apple meant more malware was hitting its desktops than its phones. Users should beware any apps that don't come from trustworthy sources, or ones that can't be validated. Thomas Brewster Thomas Brewster I'm associate editor for Forbes, covering security, surveillance and privacy. I'm also the editor of The Wiretap newsletter, which has exclusive stories on real-world ... Read More I'm associate editor for Forbes, covering security, surveillance and privacy. I'm also the editor of The Wiretap newsletter, which has exclusive stories on real-world surveillance and all the biggest cybersecurity stories of the week. It goes out every Monday and you can sign up here: https://www.forbes.com/newsletter/thewiretap I've been breaking news and writing features on these topics for major publications since 2010. As a freelancer, I worked for The Guardian, Vice, Wired and the BBC, amongst many others. Tip me on Signal / WhatsApp / whatever you like to use at +447782376697. If you use Threema, you can reach me at my ID: S2XY9B9U. If you want to tip me with something sensitive? Get in contact on Signal or Threema, and we can use OnionShare. It's a great way to share documents privately. See here: https://onionshare.org/ Read Less * Print * Reprints & Permissions [ ]