Safari bug let hackers access cameras on iPhones and Macs

Apple patched the eavesdropping flaws in January and March

A security researcher has detailed his discovery of Safari browser flaws that could have allowed hackers to eavesdrop on users by hijacking the camera and microphone on their iOS and macOS devices.

Security researcher Ryan Pickren has published an account of how he found the vulnerabilities, which “allowed malicious websites to masquerade as trusted websites" when viewed on iPhones, iPads and Mac devices using Apple's Safari browser.

Advertisement - Article continues below

“Hackers could then use their fraudulent identity to invade users' privacy. This worked because Apple lets users permanently save their security settings on a per-website basis,” Pickren explained on his website. “If the malicious website wanted camera access, all it had to do was masquerade as a trusted video-conferencing website such as Skype or Zoom.”

Pickren disclosed his findings to Apple in December 2019 and the tech giant patched the vulnerabilities in January and March. 

Head of platform operations at edgescan, Ciaran Byrne, warned that the flaw could have threatened the security and confidentiality of many businesses

“In the current landscape where more and more people are working from home, this could be a very serious risk that may allow malicious actors snoop on official meetings and gain sensitive information,” he said.

“The regular face-to-face meetings have all moved to online meetings, and are continuing as normal. The takeaway here is that no platform is fully secure and that users need to be vigilant when visiting suspicious looking URLs in any browser.”

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

Byrne advised employees to always verify the source and make sure not to click on any links. “Hackers are not taking a break due to the coronavirus outbreak,” he added.

The flaws could have also threatened the privacy of a large number of employees who are relying on video conferencing while being forced to self-isolate.

"With most people working remotely due to COVID-19, accessing webcams and microphones can have a severe impact not just to the organisation, but also to individuals home privacy,” said Javvad Malik, security awareness advocate at KnowBe4.

Related Resource

Cyber security for accountants

3 ways to protect yourself and your clients online

Download now

“Like most attacks we see though, in order to be successful, this relies on a victim clicking on a malicious link. Therefore, it's vitally important that all staff are provided with adequate and timely security awareness and training so that they are aware of these kinds of issues, and know how to avoid falling victim, and reporting these to their IT teams.”

Advertisement - Article continues below

Malik added that, in order to maximise safety, “users should also consider disconnecting any external webcams when not in use, or apply a webcam cover”.

This is not the first vulnerability discovered in Safari. Earlier this year, Google researchers discovered significant security flaws in the browser’s privacy feature that allowed for user browsing behaviour to be tracked. 

Featured Resources

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Remote working 2020: Advantages and challenges

Discover how to overcome remote working challenges

Download now

Keep your data available with snapshot technology

Synology’s solution to your data protection problem

Download now

After the lockdown - reinventing the way your business works

Your guide to ensuring business continuity, no matter the crisis

Download now
Advertisement

Recommended

Apple hit with $1.4 billion Siri patent infringement lawsuit
Policy & legislation

Apple hit with $1.4 billion Siri patent infringement lawsuit

3 Aug 2020
Apple acquires startup to turn iPhones into payment terminals
Technology

Apple acquires startup to turn iPhones into payment terminals

3 Aug 2020
Big tech CEOs grilled by House Judiciary Committee’s antitrust panel
Policy & legislation

Big tech CEOs grilled by House Judiciary Committee’s antitrust panel

30 Jul 2020
Apple is under investigation for alleged deceptive practices
Policy & legislation

Apple is under investigation for alleged deceptive practices

24 Jul 2020

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

3 Aug 2020
How to use Chromecast without Wi-Fi
Mobile

How to use Chromecast without Wi-Fi

4 Aug 2020
How do you build a great customer experience?
Sponsored

How do you build a great customer experience?

20 Jul 2020