ByDavey Winder,
Senior Contributor.
Having jumped ship from Android as my daily smartphone driver, and from Windows for my laptop, to Apple some years ago now, I am, naturally, always keen to explore any potential security issues involving the ecosystem. Usually, this will involve a threat, such as the ‘helpful message’ attack targeting iPhone users, or iOS vulnerability hunting, and sometimes, well, rarely, even a macOS backdoor. I have never had to issue a hacking warning about the Apple Podcasts app though. Until now.
“Something very strange is happening to the Apple Podcasts app,” renowned technology and security investigative journalist Joseph Cox wrote. That was, frankly, enough to grab my attention, especially as he went on to describe how the app was mysteriously opening on its own accord on both iOS and macOS and, critically, on one occasion, the opened podcast page in the app included “a link to a potentially malicious website.” The red flags in my brain were certainly getting rather agitated by this point.
Cox readily admitted he had no idea what was happening here, so he asked a cybersecurity expert who’s usually on top of every weird app behaviour with hacking potential. “The app can be launched automatically with a podcast of an attacker’s choosing,” Patrick Wardle, the macOS security expert in question confirmed, “and unlike other external app launches on macOS, no prompt or user approval is required.”
