Mozilla has patched two zero-day security vulnerabilities in Firefox that allowed backdoors to be installed on Macs, bypassing Apple's usual XProtect and Gatekeeper protections. Firefox users should update the browser immediately.
Ars Technica's Dan Goodin:
As noted by Mac security expert Patrick Wardle, XProtect and Gatekeeper provided no protection in this case, as they only scan applications that have a quarantine flag set. Fortunately, this may change in macOS Catalina.
Firefox users on Mac should update the web browser to version 67.0.4 as soon as possible to keep themselves protected.
More details can be read at Ars Technica.
Ars Technica's Dan Goodin:
Mozilla released an update on Tuesday that fixed a code-execution vulnerability in a JavaScript programming method known as Array.pop. On Thursday, Mozilla issued a second patch fixing a privilege-escalation flaw that allowed code to break out of a security sandbox that Firefox uses to prevent untrusted content from interacting with sensitive parts of a computer operating system.The zero-days were exploited by unnamed hackers this week, but so far, attacks are known only to have targeted Mac users involved in cryptocurrency.
3/ We’ve seen no evidence of exploitation targeting customers. We were not the only crypto org targeted in this campaign. We are working to notify other orgs we believe were also targeted. We’re also releasing a set of IOCs that orgs can use to evaluate their potential exposure.
— Philip Martin (@SecurityGuyPhil) June 19, 2019
As noted by Mac security expert Patrick Wardle, XProtect and Gatekeeper provided no protection in this case, as they only scan applications that have a quarantine flag set. Fortunately, this may change in macOS Catalina.
Firefox users on Mac should update the web browser to version 67.0.4 as soon as possible to keep themselves protected.
More details can be read at Ars Technica.
28 comments
Apple's wearables shipments nearly tripled in the third quarter of 2019 due to the growing popularity of the Apple Watch, AirPods, and Beats headphones, according to research firm IDC.
...
Apple TV+ series "The Morning Show" has received a Golden Globe Award nomination for best drama series, while stars Jennifer Aniston and Reese Witherspoon are nominated for best actress in a...
Apple CEO Tim Cook has been touring Tokyo, Japan over the last few days, meeting with local employees, developers, healthcare experts, and others. Cook has been documenting the trip on his Twitter...
2020 iPhones may have a custom battery protection module that is nearly 50 percent smaller and thinner than the battery protection circuit in previous iPhones, according to industry sources cited by...
Apple plans to release the new Mac Pro and the Pro Display XDR on Tuesday, December 10, according to "Save the Date" emails that Apple began sending out to some customers this afternoon.
...
Apple is investigating a popping sound issue with the new 16-inch MacBook Pro and plans to make a fix available in future software updates, the company has indicated in an internal document obtained...
Back in 2004, then-Wired editor Leander Kahney published The Cult of Mac, a photo-filled book containing an array of anecdotes about fans, collectors, and others with special connections to Apple and...
Chicago-based law firm Fegan Scott has levied a lawsuit against both Apple and Samsung, claiming that independent testing suggests the radiofrequency radiation levels in recent smartphones "far...
