Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Gatekeeper Bypass: Uncovering Weaknesses in a macOS Security Mechanism

Summary: Unit 42 researchers found that third-party archiving, virtualization and command-line utilities on macOS fail to propagate the com.apple.quarantine extended attribute, so files they handle skip Gatekeeper validation entirely. Tested examples include Archiver (which drops the attribute on extracted .archiver, ZIP, RAR and 7ZIP files), VMware Fusion (which drops it when copying files from a host to a guest macOS VM via VMware Tools), and Apple's own curl, SCP, Unzip and tar, which Apple says do not mark downloaded or unarchived files as quarantined.

What's compelling: Gatekeeper's integrity depends on developers voluntarily following Apple's inheritance guidelines, and Apple told Unit 42 the issue is the third-party developer's to fix rather than something it would directly support. Malware and adware families including CoinTicker, Shlayer and Bundlore have already used curl's missing quarantine attribute to bypass Gatekeeper, so any Mac fleet relying on these tools carries an unpatched path around its primary execution control.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related