MacOSX Gatekeeper Vulnerability

Researchers have found a new variant of malware in the wild which takes advantage of an unpatched vulnerability in OSX. Specifically, the vulnerability exists in Gatekeeper, the software responsible for rejecting unsigned, unknown applications. The attackers found that by creating a symlink to the malicious software and convincing the end user to execute the sym-linked binary, that the protections of Gatekeeper could be completely bypassed. In order for this attack to take place on a victim's computer, the attacker still must convince the victim to download and execute code.

• Only download software from trusted sources.
• Watch out for a Mac OSX patch for MacOS X version <= 10.14.5.

Details

On June 20, 2019, Threatpost reported that researchers came across a never-before-seen malware which allows an attacker to bypass MacOS X's Gatekeeper software. Gatekeeper is used to verify the authenticity of a binary and to prevent an end user from executing untrusted software. Originally, the flaw was discovered and disclosed to Apple giving them a 90 day window to fix the bug. Since Apple did not fix the bug in a timely manner, researchers released the proof-of-concept which exploits the Gatekeeper flaw. In order to execute untrusted code, the attacker creates a symlink to a malicious file. When that file is executed, it bypasses Gatekeeper's security and executes the malicious code. Researchers have observed this attack taking place in symlinks in Zip files as well as disk images. Currently, despite the fact that the malware samples were found in the wild, the nascence of the samples discovered hints that the attackers are still developing an exploit against this vulnerability.