Hackers typically have a bad reputation, but without them, many security issues would remain undetected. This was proven by Ryan Pickren, a cybersecurity Ph.D. student at the Georgia Institute of Technology.
Pickren found a dangerous vulnerability on Apple Mac devices that granted unauthorized camera access. He reported it to Apple, and for his contribution, he was paid a record-setting $100,500 bounty.
Image source: RyanPickren.com
The hacker described the hacking process in a lengthy blog post, going into detail as to how he was able to achieve the end result. The bugs revolve around exploiting issues with iCloud Sharing and the Safari 15 browser. Although the issue may seem situational and unlikely to be replicated, all it takes is one vulnerability for a hacker to gain control of a person’s device.
The vulnerability began with an iCloud sharing app called ShareBear. Through ShareBear, users are able to grant access to each other in order to seamlessly share documents. Once the user accepted an invitation to share a particular file with another person, Mac remembered this permission and never asked for it again. Unfortunately, while this seems like a nice quality-of-life feature at first glance, it can result in exploits.
As the file is stored on the cloud and not locally, it can be swapped at any time after permission is granted. This can result in a simple image or text file being turned into an executable with malicious code. Pickren used this exploit to change file types and gain full access to the user’s Mac.
Image source: RyanPickren.com
Pickren said on his website: “While this bug does require the victim to click ‘open’ on a popup from my website, it results in more than just multimedia permission hijacking. This time, the bug gives the attacker full access to every website ever visited by the victim. That means in addition to turning on your camera, my bug can also hack your iCloud, PayPal, Facebook, Gmail, etc. accounts, too.”
The file, once accessed via ShareBear, can be remotely launched at any moment without further prompt. As Pickren explains, this certainly opens the door to a potentially very dangerous hack, granting full access to the Mac in question.
Apple has fixed the bug in MacOS Monterey 12.0.1 (launched on October 25, 2021) after Pickren reported it in July. His $100,500 bounty is, according to Pickren, the highest Apple has ever offered through its security program. Apple has also recently fixed another critical bug, this time involving WebKit.
This wasn’t Pickren’s first Apple hacking rodeo. In 2019, he was able to hack into the iPhone camera and microphone, exposing a number of dangerous vulnerabilities in Apple’s code. Apple rewarded him generously for his efforts, giving him $75,000 in return for finding and reporting the bugs.