Apple dismisses Apple Gatekeeper flaw warnings from security pros
Be very careful with macOS apps downloaded from the web.
- Apple Gatekeeper can be bypassed after first launch, letting attackers swap trusted web-downloaded apps silently
- Apple does not classify this behavior as a security issue, despite researchers’ warnings
- Mac App Store apps remain protected, but web-downloaded apps like Slack face higher risk
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Apple Gatekeeper is supposed to consistently verify all macOS apps a user downloads and opens, ensuring they’re free of malicious content. But a couple of researchers successfully switched an app with malware.
According to Talal Haj Bakry and Tommy Mysk, a vulnerability in macOS allows an attacker to silently replace the main executable of any application downloaded from the web without requiring elevated privileges.
It’s not exactly a zero-click vulnerability that a remote attacker can exploit because they still need to have means of user-level execution available. Still, the researchers suggest, their test shows Gatekeeper can be tricked.
What exactly happened? The researchers say they managed to alter a macOS app downloaded from the web, and Gatekeeper, essentially, just shrugged.
Apple has concluded that the reported behaviour does not constitute a security issue since the attack isn’t “modifying” the signed executable.
Under this scenario, the downloaded app needs to have been run once. That allows Gatekeeper to complete the initial validation, aimed to prevent subsequent modifications to the application bundle.
Apple explains: “When a user downloads and opens an app, a plug-in, or an installer package from outside the App Store, Gatekeeper verifies that the software is from an identified developer, is notarized by Apple to be free of known malicious content, and hasn’t been altered.”
But the researchers say in the blog post that one can archive a downloaded, once-run app using tar (a file archiver program), and then remove the original, replacing it with a malicious version. macOS doesn’t require reauthorization. There’s even a video demonstration:
Interestingly, Apple has concluded that the reported behaviour does not constitute a security issue since the attack isn’t “modifying” the signed executable.
“Locally built app bundles are not covered by macOS guards. And this is why access to Keychain or TCC protected directories require system authorization prompts. And for users to accept those is a matter of social engineering attacks that Apple considers out of scope,” Bakry and Mysk explain.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
Be that as it may, the researchers warn that if you run a malicious app or script on your Mac, an attacker could:
- Secretly replace trusted apps you already have installed from the web with malicious versions;
- Request permissions to access private data on behalf of those trusted apps, including files in places you expect to be private, such as your Desktop or Documents folders, or your Keychain.
Besides, replacing a trusted app apparently requires neither your Mac’s password nor any special approval: it can happen entirely in the background.
Thankfully, this type of attack wouldn’t work on Mac App Store apps. They’re owned by root, so a process running without current user privileges wouldn’t be able to overwrite them.
But you should be very careful when dealing with macOS apps downloaded from the web, such as Slack, Signal, or Brave.
