Although Apple has gained a reputation for the importance it places on security, problems with the Safari browser have been apparent in recent years. Finally, it has been revealed that Apple webcams and microphones can be captured using vulnerabilities in Safari. The company eliminated these vulnerabilities with updates that it released in January and March, but before the updates, an Apple user just clicked on a single malicious link, enough to capture his camera. Security expert Ryan Pickren, who uncovered security vulnerabilities for Apple, says Safari encourages users to save their site access permissions preferences. For example, when you log in to Skype, you approve Skpye’s access to your camera and microphone. According to Pickren, the creation of a malicious fake website, similar to Skype, is seen as a sufficient step for attackers to grant access. When you give Skype access before, Safari thinks the fake site ‘Skype’ and passes the permissions to the attacker. Small carelessness can lead to big problems: The mistakes Pickren finds are actually caused by minor carelessness. For example, all URL variations in Safari’s user-approved websites’ access permission lists are treated as if they were the same site. That is, the addresses ‘https://www.example.com’, ‘http://example.com’ and ‘fake: //example.com’ are subject to the same permissions. At this point, Pickren has managed to deceive Safari by creating malicious sites directed by specially designed URLs. A hacker who manages to fool users with a fake connection, so that they can access the Apple user’s camera and microphone to record audio or video and take photos. Also, this attack is valid for all iPhones, iPads and Macs. This malfunction is not in Apple’s microphone or camera, or even Safari’s own defense system. A vulnerability that only depends on hackers’ ability to deceive and runs around all other measures. Pickren reported seven vulnerabilities to Apple’s ‘bug bounty’ program in mid-December and received a response the next day confirming the deficits. Demonstrating that hackers can take over the webcam of an Apple device using only three vulnerabilities, Pickren noticed other related gaps while continuing his research. The reason for this is that the specialist is investigating a chain of attacks that works on both macOS and iOS, since Safari is designed a little differently in these two operating systems. Pickren was entitled to $ 75,000 in rewards from Apple for reporting security vulnerabilities.
