Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Endpoint Security

Apple’s Gatekeeper Bypassed Again

A researcher has once again managed to bypass OS X’s Gatekeeper security feature, and the patch rolled out by Apple addresses the problem only temporarily.

Gatekeeper is designed to protect OS X users against malware downloaded from the Internet by automatically blocking applications that come from an unknown developer or ones that have been tampered with.

A researcher has once again managed to bypass OS X’s Gatekeeper security feature, and the patch rolled out by Apple addresses the problem only temporarily.

Gatekeeper is designed to protect OS X users against malware downloaded from the Internet by automatically blocking applications that come from an unknown developer or ones that have been tampered with.

Patrick Wardle, director of research at Synack, has analyzed the inner workings of Gatekeeper for the past year.

The expert initially discovered a Gatekeeper bypass technique involving dynamic library (dylib) hijacking. He later found another method, which he disclosed at Black Hat USA and later, in more detail, at the Virus Bulletin conference in Prague.

Wardle’s latest bypass method relies on the fact that Gatekeeper only statically checks app bundles, without verifying that they don’t execute a relatively external binary. This allows malicious actors to slip malware past the security system in a three-step attack.

The attacker must first find a signed application that loads and executes an external binary at runtime. The second step is to create a .dmg file in which the external binary is replaced with a malicious file. Finally, the attacker delivers the malicious .dmg file to users by injecting it into insecure download connections or by uploading it to third-party application stores.

Apple Gatekeeper bypass

Apple attempted to block Wardle’s attack method (CVE-2015-7024) with the release of OS X El Capitan 10.11.1.

However, the company’s fix was not very efficient since it focused on blacklisting the signed applications abused by Wardle in his demonstrations. In December, the expert simply identified another Apple-trusted binary and once again bypassed Gatekeeper.

Advertisement. Scroll to continue reading.

The expert told SecurityWeek that Apple addressed this latest bypass by adding the abused binary to the OS X anti-malware system XProtect, specifically the XProtect.meta.plist file.

However, since the underlying issue has not been resolved, the Gatekeeper bypass could be revived at any time if another signed application that loads and executes an external library at runtime is found.

“I’m sure there are other binaries that could still be abused, as the systemic issue is still present,” Wardle said via email.

The researcher says Apple has not made any significant improvements to Gatekeeper over the past months, but the company is working on a more comprehensive fix for his bypass method.

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Endpoint Security

Today, on January 10, 2023, Windows 7 Extended Security Updates (ESU) and Windows 8.1 have reached their end of support dates.

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Endpoint Security

Gigabyte has announced BIOS updates that remove a recently identified backdoor feature in hundreds of its motherboards.

Endpoint Security

Several major companies have published advisories in response to the Downfall vulnerability affecting Intel CPUs.

Application Security

Microsoft on Tuesday pushed a major Windows update to address a security feature bypass already exploited in global ransomware attacks.The operating system update, released...

Endpoint Security

The Zero Day Dilemma

CISO Strategy

Varied viewpoints as related security concepts take on similar traits create substantial confusion among security teams trying to evaluate and purchase security technologies.

Endpoint Security

When establishing visibility and security controls across endpoints, security professionals need to understand that each endpoint bears some or all responsibility for its own...