Recent findings by cybersecurity experts have revealed potential security issues in Microsoft applications for Mac computers. These vulnerabilities could allow unauthorized access to user data and system controls. Let’s break down what this means for Mac users and how to stay safe.

What’s the Issue?

Security researchers at Cisco Talos discovered weaknesses in popular Microsoft apps like Outlook, Teams, PowerPoint, OneNote, Excel, and Word when used on Macs. These vulnerabilities could potentially allow hackers to:

1. Access your microphone or camera without permission
2. Read your emails or send emails as you
3. View or change your files
4. Gain more control over your Mac than they should have

How Does It Work?

The problem stems from how these Microsoft apps are set up on Macs. They have a special permission called com.apple.security.cs.disable-library-validation that allows them to use additional software (like plugins) without strict checks. While this makes the apps more flexible, it also creates a potential security gap.

Hackers could exploit this by tricking the app into using malicious code, giving them access to the app’s permissions and capabilities.

What’s Being Done About It?

Microsoft has addressed some of these issues:

• Teams and OneNote have been updated to remove the risky permission.
• However, Microsoft considers most of these vulnerabilities low risk and hasn’t made changes to other apps yet.

How Can You Protect Yourself?

While the risk of someone actually exploiting these vulnerabilities is relatively low, it’s always better to be safe. Here are some steps you can take:

1. Keep Everything Updated: Regularly update your Mac’s operating system and all Microsoft apps.
2. Use Security Software: Install and maintain good antivirus software on your Mac.
3. Be Cautious with Permissions: Only give apps the permissions they absolutely need to function.
4. Stay Alert: Be wary of unexpected behavior from your apps or Mac.
5. Practice Safe Browsing: Be careful about clicking links or downloading files from unknown sources.

For the Tech-Savvy

For those interested in the technical details:

• The vulnerabilities are identified by CVE numbers: CVE-2024-42220, CVE-2024-42004, CVE-2024-39804, CVE-2024-41159, CVE-2024-43106, CVE-2024-41165, CVE-2024-41145, and CVE-2024-41138.
• The root cause is the com.apple.security.cs.disable-library-validation entitlement, which allows unsigned libraries to be loaded into the apps.
• Exploitation requires injecting malicious libraries into the affected applications, which is not trivial but possible for skilled attackers.

Conclusion

While these vulnerabilities are concerning, the risk of exploitation remains relatively low for most users. By staying vigilant and following good security practices, you can significantly reduce your risk. Remember, being aware and proactive is your best defense in the digital world.

References

Cisco Talos Intelligence Group – Comprehensive Threat Intelligence: https://blog.talosintelligence.com/microsoft-office-macos-vulnerabilities/
Apple Developer Documentation: https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_cs_disable-library-validation
Microsoft Security Response Center: https://msrc.microsoft.com/update-guide/
National Cyber Security Centre – Cyber Aware: https://www.ncsc.gov.uk/cyberaware/home