A bug that allows the webcam of a Mac to be hijacked has earned the discoverer a hefty $100,000 bug bounty. Apple and several other tech companies, as well as websites and software developers, often have bug bounty programs that reward people who discover critical issues in their products, on their sites, or in their software. The reward is usually a sum of money that varies based on the severity of the bug.
Apple's bug bounty program is called the Apple Security Bounty. The program rewards people who discover issues with the latest publicly available version of iOS, iPadOS, macOS, tvOS, and watchOS. To be eligible for the reward, the bug report must not only be the first to report the issue to Apple, but also describe in detail the issue (along with a working exploit among other requirements). Depending on the type of security issue discovered, the reward earned can be as high as $1,000,000.
According to 9to5Mac, a Georgia Institute of Technology Ph.D. student, Ryan Pickren, found a number of vulnerabilities in iCloud Sharing and Safari 15 that made it possible for him to gain unauthorized camera access to a Mac's webcam. The vulnerability is reported to have been present in the iCloud sharing app named 'ShareBear.' There is a detailed process on Ryan Pickeren's site as to how the hack is carried out, but the ShareBear app plays an important role in the execution. The app allows a user (referred to as the sender) to share a document with another person, and if that person accepts the invitation, it doesn't ask for permission again if the sender has to reopen the file. Since the file is stored remotely, the sender can modify it or even change it to a different file type such as malware. The victim's Mac will be fooled into running the malware, which can activate a handful of actions — one of which is turning on the webcam and microphones.
Don't Fret, The Vulnerability Has Been Fixed
Apple has added a feature to Macs that turns on an LED when the webcam is in use, so that might give it away that a device has been hacked. However, perpetrators may execute the malware to turn on the webcam when the victim is sleeping or when they are not paying attention to the computer. Thankfully, there's no need to worry too much as the bugs were submitted to Apple in July 2021 and were then patched early this year. Mr. Pickren was rewarded with $100,500 as a bounty for all of his work. It's worth mentioning this isn't the first bounty Apple's paid to Pickren. A few years ago, he was rewarded with $75,000 for discovering a vulnerability that granted him access to the camera and microphones on an iPhone without having privacy permissions.
Several manufacturers including Apple have incorporated safety features both on a software and hardware level in their products to let users know when their webcam or microphone is in use. On Android 12, users see a microphone or camera icon when the mic and or camera is in use. In cases where they are not running any app that requires the use of the microphone or camera, a visible icon will let them know their device has been compromised. On the hardware side, some PC manufacturers have added a slider that covers the webcam when not in use, while others have a mute switch that deactivates the microphones.
Source: 9to5Mac, Ryan Pickren