Apple’s Screen Sharing vulnerability is now being actively exploited on multiple systems in the Netherlands, after the company had already released macOS fixes for the flaw.
The bug lets attackers view a user’s screen, open files and take broad control of the targeted computer, effectively giving them access similar to physical possession of the machine.
The Netherlands National Cyber Security Centrum warned that it had received notifications of the vulnerability being used on multiple systems. In all reported cases, attackers gained root access and uploaded crypto mining software.
Ars Technica reported that the vulnerability had initially not been seen in the wild when Apple released security updates for it several weeks ago. Those updates were issued as a precaution before confirmed active abuse was reported.
Apple has already released software fixes for affected macOS versions Tahoe, Sequoia and Sonoma. Users can install the updated versions to close the vulnerability.
The flaw is being exploited when port 5900 is exposed to the internet. Security experts recommend keeping that port closed, especially on systems using screen sharing.
Users can also disable Apple’s Screen Sharing tool through the System Settings menu as an additional mitigation step. A similar screen-sharing bug was also reported in Zoom, which has issued its own patch.
Featured image credit
