Researchers replace macOS apps with malicious clones, exposing Gatekeeper flaw
Apple's security mechanism fails to detect tampered applications downloaded from the web.
1Gatekeeper's Vulnerability
Apple's Gatekeeper security mechanism in macOS contains a flaw that allows downloaded applications to be replaced with malicious versions. Researchers demonstrated how app bundles can be modified to exploit this weakness.
2Attack Methodology
Attackers can archive executed apps using tar and replace them with malicious versions. Despite detecting changes, macOS skips revalidation due to cached trust data, creating a security blind spot.
3Affected Applications
Popular apps like Brave, Slack, Signal, and Visual Studio Code—downloaded outside the Mac App Store—are vulnerable. App Store-distributed apps remain protected by root permissions.
4Potential Attack Vectors
Command-line tools, terminal command injections, or supply chain attacks via package managers can exploit this flaw. Attackers may also display deceptive prompts leveraging the app's trusted appearance.
5Apple's Stance
Apple dismissed the issue by categorizing modified apps as 'locally built bundles' outside its security scope. The company considers social engineering aspects beyond its responsibility.
6User Risks
This vulnerability increases risks of unauthorized data access and system compromise. Developers and enterprise users should regularly verify application integrity, especially for web-downloaded software.