A newly disclosed flaw allows attackers to hijack a fully updated Mac simply by including a specific type of URL in an email attachment

The flaw, previously reported by Bleeping Computer, exploits the Mac's handling of "inetloc" files, a file format that contains links to Internet locations such as websites and other servers

Independent security researcher Park Minchan has found that prefixing links in inetloc files with "file://" instead of "http://" or "https://" allows Macs running the fully updated macOS 116 Big Sur We discovered that it is possible to execute arbitrary code, ie, hack, on a Mac running the fully updated macOS 116 Big Sur (The "file://" prefix specifies a file on the local PC)

"These files can be embedded in emails, and when users click on them, they execute the commands embedded in them without prompting or warning the user," an unsigned SSD-Disclosure bug reporting site reported today (September 21) The posting stated

Apple appears to have patched this flaw so that "file://" cannot be exploited However, Park discovered that swapping the case of the letters so that the prefix is "File://" or "fIle://" also works (URLs are generally case-insensitive, so "hTTpS://tomsGUIdecoM" works as well as "https://tomsguidecom")

") This may seem like a zero-day flaw, but it is the kind of flaw Apple knew about but did not patch properly Tom's Guide has sent an email to Apple seeking comment, but has not yet received a response

"We have notified Apple that FiLe:// (just mangling the value) does not appear to be blocked, but have not received any response from them since the report was made," the SSD-Disclosure post states As far as we know, no patch has been applied to this vulnerability at this time"

Bleeping Computer tried the eight-line proof-of-concept exploit listed at the end of the post and confirmed that it does indeed work on macOS Big Sur tom's Guide did not have a chance to try this exploit

For now, the only way to avoid this type of attack is to avoid opening unexpected email attachments As of this writing, none of VirusTotal's antivirus malware detection engines flag proof-of-concept code as malicious