Apple blocked eight faulty web certificates that scammers could have abused, but an engineer warns Macs may still trust them. Here is what to do.
Apple has blocked eight web security certificates that could have let scammers build fake websites that look real. The catch is that Macs may still trust them. A security engineer says macOS does not check whether a certificate has been canceled.
A certificate is a digital ID that proves a website is who it claims to be. The eight in question are called intermediate certificates, which vouch for other sites. A mistake in a script used to make them left their secret keys easy to guess. Testing just 256 possible numbers could reveal them.
The certificates have now been revoked, meaning officially canceled. Steps were also taken so future certificates will not have the same flaw. Apple, Google and Mozilla have each blocked them in their browsers.
Anyone who uses a Mac or Safari could be touched, including small offices that rely on them. Mozilla cryptography engineer Dennis Jackson warns that if a Mac has already accepted one of these certificates, it will keep doing so. He says the same goes for a built-in Mac tool called curl, which developers and IT staff use to fetch web content.
There is currently no evidence the certificates were used in real attacks. Apple is also likely to fix the gap in an upcoming security update, though no date has been given.
The steps in the alert box above cover the basics: updates, careful checks of web addresses, and extra sign-in protection. Watch for Apple's next macOS and Safari updates, and ask your IT provider if they plan to add protection sooner.
Keep your Mac updated, check web addresses before signing in, and watch for Apple's next security update.
A viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you callThe Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone calls
