SB2018090621 - Spoofing attack in Apple Safari

Description

This security bulletin contains information about 1 security vulnerability.

1) Spoofing attack (CVE-ID: N/A)

The vulnerability allows a remote attacker to conduct spoofing attack.

The weakness exists due to the way macOS processes URI handlers with enabled "Open Safe Files" setting in Safari browser. A remote attacker can create a specially crafted web page, trick the victim into clicking on a spoof dialog box and force unauthorized downloading of malicious file (e.g. ZIP-archive). Once downloaded, the archive will be automatically extracted.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note: the vulnerability is being exploited in the wild by the WindShift APT actor against government organizations in the Middle East.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://objective-see.com/blog/blog_0x38.html
• https://gsec.hitb.org/materials/sg2018/D1%20COMMSEC%20-%20In%20the%20Trails%20of%20WINDSHIFT%20APT%2...