Mac OS X vulnerability to hijacking via third-party apps
ArsTechnica is reporting that Mac OS X Yosemite (10.10) and El Capitan (10.11) are vulnerable to man-in-the-middle (MITM) hijacking through Sparkle, a third-party software framework that certain third-party apps use to receive updates.
In a MITM attack like this one, the software is made vulnerable during the update process and malicious code can then be installed to take control of the computer.
There is a patch available (at the time of this post) but use of it has to be taken care of by the developer. Sparkle’s documentation does note that due to how it works, software that uses it can be vulnerable without making a few modifications at the developer level.
The vulnerability has been found so far in versions of Camtasia, uTorrent, and VLC Media Player.
For information on how the vulnerability was discovered (it is pretty advanced), check out this summary from Radoslaw Karpowicz, the man who found it.
For more information on this vulnerability (in more layman’s terms), check out ArsTechnica.com.