Researchers replace downloaded macOS apps with malicious versions, Apple remains unresponsive
Gatekeeper's vulnerability leaves the door open for malware attacks.
1Gatekeeper's Weak Spot
Apple's Gatekeeper defense mechanism in macOS contains a vulnerability that allows downloaded apps to be replaced with malicious versions. Researchers demonstrated that attackers with user-level code execution privileges can exploit this flaw.
2Attack Mechanism
Attackers can archive a once-run and Gatekeeper-verified app and replace the original with a malicious version. Although macOS detects the change, cached trust data causes it to skip revalidation.
3Affected Applications
This attack method targets popular apps like Brave, Slack, Signal, and Visual Studio Code downloaded from outside the Mac App Store. Apps from the App Store remain unaffected due to root permissions.
4Attack Scenarios
Attackers can gain user-level code execution through various methods like command-line tools, terminal commands, or malicious package managers. This privilege is sufficient to bypass Gatekeeper.
5Exploiting User Trust
Modified apps can present deceptive prompts mimicking trusted applications, amplifying the impact of social engineering attacks and risking users' sensitive information.
6Apple's Response and Implications
Apple closed the issue by classifying it under 'locally built app bundles,' but this highlights weaknesses in macOS's security model. Users must exercise caution with apps downloaded from the internet.