New Mac Exploit Easily Bypasses Gatekeeper Security, Could Allow Installation of Malicious Apps

[MacRumors]

Apple introduced Gatekeeper in 2012, creating it as a method of protection for users against malicious threats by adding various layers of security during installation of Mac apps. The feature is intended to ensure that apps users try to install on their Macs are legitimate and signed by a registered developer, minimizing the threat of malware. But now, a security researcher has discovered a simple method of bypassing Gatekeeper using a binary file already trusted by Apple to attack a user's computer (via Ars Technica).

Gatekeeper is meant solely to check the initial digital certificate when an app is downloaded on a Mac, ensuring that the program has been signed by an Apple-approved developer or at least comes from the Mac App Store itself before allowing the installation to proceed.

"If the application is valid--so it was signed by a developer ID or was (downloaded) from the Mac App Store--Gatekeeper basically says 'OK, I'm going to let this run,' and then Gatekeeper essentially exits," Patrick Wardle, director of research of security firm Synack, told Ars. "It doesn't monitor what that application is doing. If that application turns around and either loads or executes other content from the same directory... Gatekeeper does not examine those files."

Even if Gatekeeper is enhanced to its highest level of security settings, the new exploit can take advantage of a computer. Once the trusted file makes its way past the security program, it can then execute a handful of other malicious programs attached with the rest of the installation and gains the ability to install malicious software such as password-stealing programs, apps that can capture audio and video from a Mac's camera, and botnet software.

The researcher who discovered the exploit sent news of it to Apple about 60 days ago and "believes they are working on a way to fix the underlying cause or at least lessen the damage it can do to end users." Since then, an Apple spokesperson has confirmed the company is working on a patch for the issue and has asked that the identities of the specific files used in the exploit not be disclosed. Wardle plans to showcase his research on the Gatekeeper exploit at the Virus Bulletin Conference on Thursday in Prague.

Article Link: New Mac Exploit Easily Bypasses Gatekeeper Security, Could Allow Installation of Malicious Apps

 

[Cezar`]

This is known for ages...

 

[garylapointe]

I tend to assume that there are ways around all forms of security protection.
But the app store has always made me feel a little safer...

Gary

 

[Quu]

Hopefully Apple fixes this behaviour. Quite the obvious flaw from a designers perspective I'm surprised they didn't notice it earlier.

 

[dwaltwhit]

I would be more concerned if there were confirmed instances of this happening.

 

[J. Jizzle]

You are always going to be safer using Mac devices than Android or Windows devices.

 

[cariacou]

Your Mac has either a 14nm Samsung CPU or a 16nm TSMC CPU.

To check which one you have, please click on this link...

 

[andiwm2003]

as long as you download apps only from the app store this should not be a problem, correct?

 

[DavidTheExpert]

There's a very simple way to avoid malware on any computer: Don't install anything you don't trust.

 

[Codyak]

-Gategate

 

[mgmusicman94]

"Apple is Doomed"

 

[manu chao]

as long as you download apps only from the app store this should not be a problem, correct?

I think the idea here is that an App Store app can, once it is running download code from the Internet (sure nothing it stops it downloading stuff from the cloud) and execute it.

 

[JimmyHook]

This is an old one. The "fix" is to download software from trusted sources only. Which is what you should do anyway. The guy even said it isn't a bug, it's a limitation in gatekeeper.

 

[JimmyHook]

I think the idea here is that an App Store app can, once it is running download code from the Internet (sure nothing it stops it downloading stuff from the cloud) and execute it.

No, no, no. Apple checks App Store apps to see if they behave in this manner. This is more about random web downloads

 

[Lord Hamsa]

I'm not particularly concerned about this "exploit". Anyone seeking to make use of it could just as easily put the malware directly in the developer-signed application in the first place. Why go through the extra steps of invoking additional applications when you can do it in the initial one?

The only thing that keeps the self-signed applications on the up-and-up is that the developer ID can be revoked for bad behavior - whether it's in the signed application or a bundled application called by it makes little difference if the developer is doing this intentionally.

The only real attack vector here is if an application is known to invoke "helper" executables, and someone executes a man-in-the-middle attack to create a modified distribution with the legit signed main application but with one or malware-infected helper executables, and then pass that off as a legit bundle. Possible, but limiting downloads to trusted/official sites will prevent that.

 

[KALLT]

as long as you download apps only from the app store this should not be a problem, correct?

These apps are sandboxed anyway so they wouldn’t be able to access anything outside of their own sandbox.

If I understood this correctly, you download, say, two files, one an executable file the other a malicious supporting file. Once you open the executable file, Gatekeeper will stop it and ask for your permission. After you grant permission, the executable file loads the malicious supporting file. I can see how this can be a problem. An app could be hijacked in this way if the developer of the app was sloppy.

However, the only things Gatekeeper does is check whether an executable file has been signed with a valid ID and the file integrity is intact. It will thus only protect against unsigned executables as well as signed executables that have been tampered with or whose signature has been declared invalid by Apple. It doesn’t check anything else. You can easily spread malware as long as you are registered with Apple and sign your applications. Gatekeeper won’t protect you against this, but the assumption is of course that Apple can intervene and stop further spreading and will be able to take further action with the developer’s contact details.

I'm not particularly concerned about this "exploit". Anyone seeking to make use of it could just as easily put the malware directly in the developer-signed application in the first place. Why go through the extra steps of invoking additional applications when you can do it in the initial one?

Gatekeeper would notice this. This is what happened with XcodeGhost recently.

 

[felipur]

I must be missing something about this article. Gatekeeper has never been about preventing apps from doing things. It's about preventing apps from being modified and redistributed so users mistakenly trust them and it's about accountability - the developer is known so malicious apps can be traced to people. This seems to be an "exploit" that is in fact by design.

 

[Jess13]

-Gategate

Perfect haha.

 

[konqerror]

This is an old one. The "fix" is to download software from trusted sources only. Which is what you should do anyway. The guy even said it isn't a bug, it's a limitation in gatekeeper.

You have a quaint and obsolete notion. What's "trusted"? You want, for example, VLC, you have to download it from a unpaid network of mirrors. Commercial software comes from various CDNs. Even the Apple stores allow local caching proxies (using OS X Server), so you may not be downloading from Apple. How do you know it wasn't tampered with in the CDN? Did you use TLS/HTTPS when you downloaded it? How do you know somebody on the network didn't tamper with it then? It takes up too much resources to encrypt gigabyte size apps.

You need code signing as an "end-to-end" solution which tries to solve all of these issues in one go.

 

[Carlanga]

Gatekeeper is always off for me. So don't care.

 

[KALLT]

Gatekeeper is always off for me. So don't care.

Why would you do that?

 

[NMBob]

as long as you download apps only from the app store this should not be a problem, correct?

As long as they weren't compiled with a compromised copy of Xcode.

Given all the varied things that have been allowed in and/or pulled from the App Store it's kinda hard to figure out exactly WHAT they actually check at the App Store. It doesn't seem like very much.

 

[JimmyHook]

You have a quaint and obsolete notion. What's "trusted"? You want, for example, VLC, you have to download it from a unpaid network of mirrors. Commercial software comes from various CDNs. Even the Apple stores allow local caching proxies (using OS X Server). How do you know it wasn't tampered with in the CDN? Did you use TLS/HTTPS when you downloaded it? How do you know somebody on the network didn't tamper with it then? It takes up too much resources to encrypt gigabyte size apps.

You need code signing as an "end-to-end" solution which tries to solve all of these issues in one go.

There would be absolutely no fix for your suggestion. That's not a Gatekeeper issue. Not an Apple issue. No manufacturer could stop that line of attack. In the end, you sometimes have to just play dice.

 

[QuickDraw]

I must be missing something about this article. Gatekeeper has never been about preventing apps from doing things. It's about preventing apps from being modified and redistributed so users mistakenly trust them and it's about accountability - the developer is known so malicious apps can be traced to people. This seems to be an "exploit" that is in fact by design.

Maybe I am missing something too,but isn't that exactly the problem? GateKeeper just seem to check the signed executable, but doesn't check anything else in that package? So the attacker can modify the rest of the package? Shouldn't gatekeeper be able to put a hash over the whole package and not just the first executable? again, might misunderstand this, maybe i should read the ars article

 

[konqerror]

There would be absolutely no fix for your suggestion. That's not a Gatekeeper issue. Not an Apple issue. No manufacturer could stop that line of attack. In the end, you sometimes have to just play dice.

No, the fix is you need code signing that actually works right. That ensures the code you are running was not changed from the Developer and/or Apple's review. Then it doesn't mater how insecure the intermediate steps are.

This is called the end-to-end principle of the Internet.