Full Report
Malware already running on a Mac can quietly take over Meta's Muse assistant and use the broad access its owner granted the app, security researcher Patrick Wardle has shown in a proof-of-concept released on September 21. It works by changing a hidden setting so that when the user taps the microphone and dictates a prompt, the words go to the attacker instead of Meta. The flaw is in
Analysis Summary
# Vulnerability: Meta Muse Assistant "Ghost Dictation" Prompt Hijacking
## CVE Details
- **CVE ID:** Not yet assigned (Disclosed by Patrick Wardle, September 21, 2024)
- **CVSS Score:** N/A (Estimated 6.5 - 7.2 Medium/High - Requires local execution)
- **CWE:** CWE-15: External Control of System or Configuration Setting
## Affected Systems
- **Products:** Meta Muse (Desktop Assistant for macOS)
- **Versions:** All versions prior to the September 2024 disclosure.
- **Configurations:** Systems where Meta Muse has been granted permissions for microphone access and system-wide automation.
## Vulnerability Description
The vulnerability stems from the way Meta Muse stores and references its backend API endpoints and configuration settings. On macOS, the application utilizes a configuration file (or hidden preference setting) that is not properly protected by the App Sandbox or System Integrity Protection (SIP) from other local processes.
A malicious process already running on the Mac can modify the application's preference files to point the dictation processing endpoint to an attacker-controlled server. When the user interacts with the assistant via the microphone, the audio is transcribed/processed, and the resulting prompt is transmitted to the rogue endpoint instead of Meta’s legitimate infrastructure.
## Exploitation
- **Status:** PoC available (Released by researcher Patrick Wardle)
- **Complexity:** Low (Requires simple modification of a plist/configuration file)
- **Attack Vector:** Local (Malware must already be executing on the host to modify settings)
## Impact
- **Confidentiality:** High (Sensitive dictated information, passwords, or personal data are redirected to attackers)
- **Integrity:** Medium (Attackers can potentially influence the responses returned to the user)
- **Availability:** Low (Primary impact is data exfiltration)
## Remediation
### Patches
- Users should update to the latest version of Meta Muse available through official Meta distribution channels. Meta has reportedly addressed the lack of validation for these configuration parameters.
### Workarounds
- Revoke Microphone permissions for Meta Muse in **System Settings > Privacy & Security > Microphone** if the app is not in active use.
- Monitor for unauthorized changes to the application's `Library/Preferences` or `Application Support` directories.
## Detection
- **Indicators of Compromise:**
- Unexpected outbound network connections from the Meta Muse process to unknown or non-Meta IP addresses/domains.
- Modifications to Meta Muse configuration files by processes other than the application itself.
- **Detection methods and tools:**
- Use macOS security tools like **LuLu** or **Little Snitch** to monitor and block unexpected outgoing connections.
- Use **BlockBlock** or similar file-monitor tools to detect persistent changes to application preference files.
## References
- Patrick Wardle's Research (Objective-See): hxxps[://]objective-see[.]org/blog/blog_0x7B[.]html
- News Coverage: hxxps[://]www[.]securityweek[.]com/mac-malware-can-hijack-metas-muse-assistant/