CISA flags active exploitation of Apple OS flaw tied to data-theft malware

En bref

• CVE-2024-27834 affects multiple Apple operating systems and involves flawed authentication.
• CISA placed the flaw on its Known Exploited Vulnerabilities list on Wednesday.
• Unidentified actors use it to deliver malware that steals information from devices.
• CVSS is 5.5 medium, but active abuse and KEV listing raise response priority.

On Wednesday, the U.S. Cybersecurity and Infrastructure Security Agency placed CVE-2024-27834 on its Known Exploited Vulnerabilities roster. The issue affects several Apple operating systems and stems from inadequate authentication checks. The published CVSS rating is 5.5, a medium score, yet the flaw is being used in real attacks.

Unidentified threat actors are leveraging the bug to distribute malicious software built to steal data from targeted systems. The exploitation targets a weakness Apple had already fixed, so devices that remain unpatched are still exposed. The campaign’s exact scope is not public, but the mix of live abuse and data theft makes the problem more urgent than the base score alone implies.

K-12 districts and government users running Apple laptops, tablets, and phones should treat the flaw as a priority. Because the defect spans multiple OS versions, inventory checks must confirm which endpoints are still vulnerable. Mobile devices used for email, student records, and administrative access deserve special attention, since stolen credentials or session data can enable follow-on intrusions.

CISA’s listing signals that exploitation has been observed in the wild, not merely theorized. Federal agencies face remediation deadlines under the KEV process, and state and local education organizations should adopt similar urgency. The medium CVSS figure reflects technical scoring, but real-world abuse and the delivery of data-theft code elevate operational risk.

Watch for updated vendor guidance, proof-of-concept code, and reports of targeted phishing or watering-hole activity. Attackers may combine the authentication bypass with social engineering to reach higher-value accounts. Monitor Apple patch levels, endpoint alerts for credential access, and unusual outbound traffic from Macs and iOS devices.

À faire maintenant

1. Immediately inventory all Apple devices and confirm they run the latest macOS, iOS, iPadOS, and other affected OS updates containing the fix for CVE-2024-27834.
2. Prioritize patching internet-facing and high-value endpoints used for email, student data, and administrative access; enforce update compliance through MDM.
3. Hunt for signs of data-theft malware: unusual process execution, credential-store access, unexpected network connections, and new persistence items.
4. Review authentication logs for anomalous access and reset credentials and sessions on any suspected compromised device.
5. Apply CISA KEV-style remediation timelines and document exceptions for devices that cannot be updated immediately.
6. Block known malicious indicators if available and alert users to phishing attempts that could deliver the exploit.
7. Enable enhanced logging on Apple endpoints and forward it to the SIEM for detection.

Références CVE

• CVE-2024-27834

Source originale

The Hacker News