And while such infections, yes, do require user interaction, they are still massively successful.

The majority of Mac malware infections are a result of users (naively, or mistakenly) running something they should not. Here, we'll also discuss a novel idea aimed at detecting previous attacks that exploited this flaw, and provide a simple Python script, scan.py, to automate such detection! And good news, once patched macOS users should regain full protection.įinally, we'll wrap things up with a brief discussion on protections, most notably highlighting the fact that BlockBlock already provided sufficient protection against this 0day. Next, after reverse-engineering Apple's 11.3 update, we describe how Cupertino addressed this flaw.

In this section of the post, we briefly discuss this worrisome finding. Unfortunately a subversive malware installer is already exploiting this flaw in the wild, as a 0day. Such misclassified apps, even if unsigned (and unnotarized), will be allowed to run uninhibited. In this section, we'll detail the flaw which ultimately results in the misclassification of quarantined items, such as malicious applications. The core of the blog post digs deep into the bowels of macOS to uncover the root cause of the bug. It is important to understand these core macOS security mechanisms, as they are the very mechanisms the bug trivially and wholly bypasses. We begin the post with a discussion of common (user-assisted) infection vectors and highlight security mechanisms that Apple has introduced to keep users safe. There’s a rather massive amount of information presented in this blog post, so let’s break down what we’re going to cover:

However, as the underlying cause of the bug remained unknown, our blog post focuses on uncovering the reason …ultimately discovering a flaw that lay deep within macOS’s policy subsystem(s). He’s posted a must read, that provides step by step details on how this bug may be practically leveraged to surreptitiously deliver payloads in red team exercises: 'macOS Gatekeeper Bypass (2021) Addition'. Epic find Cedric! 🤩Ĭedric notes the bug manifested while building red team payloads via the appify developer tool. The security researcher Cedric Owens uncovered the flaw and initially reported the bug to Cupertino. Apple patched the bug as CVE-2021-30657, noting 'a malicious application may bypass Gatekeeper checks'

Mac os security vulnerability