Sandboxed Mac Apps Can Record Screen Any Time Without You Knowing (bleepingcomputer.com)

Posted by msmash on Sunday February 11, 2018 @04:41AM from the security-woes dept.

Catalin Cimpanu, writing for BleepingComputer: Malicious app developers can secretly abuse a macOS API function to take screenshots of the user's screen and then use OCR (Optical Character Recognition) to programmatically read the text found in the image. The function is CGWindowListCreateImage, often utilized by Mac apps that take screenshots or live stream a user's desktop. According to Fastlane Tools founder Felix Krause, any Mac app, sandboxed or not, can access this function and secretly take screenshots of the user's screen. Krause argues that miscreants can abuse this privacy loophole and utilize CGWindowListCreateImage to take screenshots of the screen without the user's permission.

1 of 59 comments (clear)

Min score:

Reason:

Sort:

Re:Implemented incorrectly by Anonymous Coward · 2018-02-11 05:07 · Score: 3, Interesting

This is Tim Cook's Apple we're talking about here. The guy allowed a release of an OS where one could log in with a blank root password. Yeah, I know, he's a "supply chain genius" which is why the iPhone X wasn't available for three months after it was announced and the fucking homepod just shipped two months late.