Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security Apple IT Technology

Apple Mistakenly Approved a Widely Used Malware To Run on Macs (techcrunch.com) 44

Posted by msmash from the security-woes dept.
Apple has some of the strictest rules to prevent malicious software from landing in its app store, even if on occasion a bad app slips through the net. But last year Apple took its toughest approach yet by requiring developers to submit their apps for security checks in order to run on millions of Macs unhindered. From a report: The process, which Apple calls "notarization," scans an app for security issues and malicious content. If approved, the Mac's in-built security screening software, Gatekeeper, allows the app to run. Apps that don't pass the security sniff test are denied, and are blocked from running. But security researchers say they have found the first Mac malware inadvertently notarized by Apple. Peter Dantini, working with Patrick Wardle, a well-known Mac security researcher, found a malware campaign disguised as an Adobe Flash installer. These campaigns are common and have been around for years -- even if Flash is rarely used these days -- and most run unnotarized code, which Macs block immediately when opened. But Dantini and Wardle found that one malicious Flash installer had code notarized by Apple and would run on Macs. Wardle confirmed that Apple had approved code used by the popular Shlayer malware, which security firm Kaspersky said is the "most common threat" that Macs faced in 2019.
This discussion has been archived. No new comments can be posted.

Apple Mistakenly Approved a Widely Used Malware To Run on Macs More

Apple Mistakenly Approved a Widely Used Malware To Run on Macs

Comments Filter:

  • Until Apple begins requiring that all software be notarized before it is allowed to run on a Mac at all?

    Just wondering as I think both Apple and Apple's customers like the idea of strict vertical integration and banishment of third party app installations. At least, based on what Apple fans on slashdot have been saying, they don't like the idea of it being possible to install applications that Apple hasn't approved.

    • I think that's already been the default for several years. However, the end user can choose to circumvent that by right-clicking the app and selecting "open", then confirming on the subsequent pop-up that they wish to continue (the default is to NOT continue).

      I believe it requires admin credentials, though, so it's not possible if you can't run as an admin.

      • Typing the following in the command line disables signature checking:

        sudo spctl --master-disable

        Of course, you need admin privileges for that.

    • At least, based on what Apple fans on slashdot have been saying, they don't like the idea of it being possible to install applications that Apple hasn't approved

      I think that most Apple users want the status quo: Absolute rules for mobile App installation; but a way to bypass notarization restrictions on software on Macs.

      No idea who or what missed this malware incursion; but I hope that one false negative in several years does not cause any official action by Apple regarding Application installation, other than a thorough internal review and possible updating of their Notarization procedure.

      Apple has been significantly hardening macOS in the past few years, and this

      • Who's to truely say that this is a one time event, and not the first one openly mentioned about? Malware has been posted on the iOS store before (XcodeGhost is the first that comes to mind, but not the only. Others have been posted as proof of concept that Apple declared was just not possible). And the whole Epic Fortnite iOS thing going on should have only further showed that Apples screening process is really getting bad and worse. The whole different payment processor should have been caught before it wa
        • Apple screening process has been garbage from day 1. Software against the ToS like a flashlight app that had an entire tethering sub system hidden inside, several researchers were banned from the store for publishing malware (and getting several thousand downloads)
    • Very much not the case. A lot of people feel that it is ruining it for macs to restrict them similar to iOS. There are mac users jumping ship, despite having to start over on another ecosystem because of this move by Apple to iOSify the desktop experience. That said, Gatekeeper is, at this stage, more of an annoyance than anything. You can still run anything you want, you just have to open system preferences, put in your admin password and click a button that says âopen anywayâ(TM). If they take
  • the Preeminent gatekeeper of user safety.
    Guess not so much when it comes to really taking the measures they should.
    Wonder if they will catch the Apple employees that got paid to slide the malware in to the app store. It did not happen by accident.
    • That this is apparently the first malware that slipped through Apple's approval process, after who knows how many attempts, only emphasizes the value of living inside Apple's walled garden. Note that Apple has the ability to revoke approvals, as the article says "Apple revoked the notarized payloads after Wardle reached out, preventing the malware from running on Macs in the future."

      • "Apple revoked the notarized payloads after Wardle reached out, preventing the malware from running on Macs in the future."

        Apple closed the barn door after the horse got away, which is good of them, I suppose.

        • As opposed to allowing everything an antivirus doesnâ(TM)t detect as being malware, it is undeniable that Apple has done really well here. If malware does run, it is constrained by mandatory access controls which protect important system files and many types of key user files (e.g. Photos) alike - like how SELinux works on Android. It also canâ(TM)t inject keystrokes into other apps or record the screen, webcam or microphone. Windows finally has zero tolerance mode as an option on its built in a
          • denied. Even with the 'iron fist' there have been many apps that had secret functionality inside. Many researchers demonstrated command and control (and the only reason they get booted is because the researchers reveal themselves

      • Re: (Score:2)

        by tlhIngan ( 30335 )

        That this is apparently the first malware that slipped through Apple's approval process

        False, this was not Apple approved.

        Apps on Mac can be of three states. Unsigned, Signed, and Mac App Store. Mac App Store has the 30% and Apple approvals and all that.

        Signed means you paid for a developer certificate and signed the app, then had the app signed again by Apple (notarized). These apps do not undergo any approval process - basically it's just an automated check against known malware.

        Unsigned apps are just tha

    • the Preeminent gatekeeper of user safety.
      Guess not so much when it comes to really taking the measures they should.
      Wonder if they will catch the Apple employees that got paid to slide the malware in to the app store. It did not happen by accident.

      You do realize, of course, that you just accused Appleâ(TM)s Approval Process as being flawed, and then stated that it must have been someone internally with the power to subvert said Process to make this happen?

      I think you just called Appleâ(TM)s Approval Process flawless, save for the exceedingly unlikely possibility of a bad actor internal to that Process.

      If so, thatâ(TM)s a great sign; because you can offset that possibility easily by a few additional checks and sign-offs, rather than an

    • Re:And here I thought Apple was (Score:4, Informative)

      by Anubis IV ( 1279820 ) on Monday August 31, 2020 @04:49PM (#60460072)

      A) The malware wasn't in the Mac App Store. Users had to find and download it themselves.

      B) Saying Apple "approved" the malware is a massive overstatement. Apple merely notarized it as coming from the developer who sent it to them to be notarized. Notarization doesn't involve the same sort of onerous approval process that we hear about with the iOS App Store or the Mac App Store for the simple reason that these apps aren't being distributed in those app stores.

      C) One of notarization's primary functions is to establish an accountability chain when something goes awry, as it did here. Because it worked, Apple was able to immediately revoke the developer's credentials, preventing this malware (and any other linked to that developer account) from launching on any Internet-connected Mac.

      D) As for your suggestion that this was a malicious act on the part of an Apple employee, see: Hanlon's razor.

  • You can run anything you like from the terminal command line. I guess they figured if you can use a unix command line you know (better) what youre doing.

  • Let's not upset the, uh... oh shit, Apple Cart(el)

  • Obviously 30% isn't enough to catch all the malware, it's about time to raise it to 35%.

  • The notarization process is a purely automated process, there are no humans involved in approving or denying requests for notarization. The fact that some malware was able to evade whatever checks Apple has for maliciousness should not be terribly surprising: think of how much other malware has eluded anti-virus scanners, Google Play's app approval tests, and so on.

    Apple will update their notarization servers to detect malware like this, but the cat-and-mouse game will continue, as the malware authors will

  • A good culling isn't a bad thing every now and then.

  • ... or subversive mentions of money Apple rakes in from 3rd-party software sales - so from the view point of Apple, the software check was entirely successful.

  • If Steve jobs were alive today, someone at Apple would be getting kicked in the balls for approving anything that has to do with Flash Player.

    https://www.cnn.com/2011/11/09... [cnn.com]

    If this App would have had Payment links, it surely would have been scrutinized to the level of Fornite and kicked out of the App store and had the developer keys revoked.

    Apple is falling apart. The MBAs are taking over and the techies are getting shoved into the basement or the roof of the flying saucer.

    Note to MBAs, you can only make money until the customers figure out your product is crap. You are losing your shine and headed for the land of Microsoft.

Slashdot Top Deals

An authority is a person who can tell you more about something than you really care to know.

Close