Menu
Researcher finds fault in Apple's Gatekeeper patch

Researcher finds fault in Apple's Gatekeeper patch

Synack's Patrick Wardle says Gatekeeper can still be tricked into letting malware run

Apple hasn't completely fixed a weakness in Gatekeeper, its security technology that blocks harmful applications from being installed.

Patrick Wardle, director of research with the company Synack, said in an interview he reverse-engineered a patch Apple released in October and found it wasn't quite the fix he expected.

Wardle found he could still bypass Gatekeeper and install malware. He's going public with his latest findings on Sunday at the Shmoocon security conference, which starts Friday in Washington, D.C. 

"Releasing a patch claiming it is fixed kind of doesn't solve the problem," Wardle said. "Users will think they're secure when they're not."

Wardle, who has studied OS X extensively, found the original bug that Apple patched, CVE-2015-7024.

When a user downloads an application, Gatekeeper checks if it has a digital signature and blocks those that don't have one approved by Apple.

Wardle found that Gatekeeper only verifies the initial executable that the user double-clicks on. So Wardle found some other code signed by Apple that, when run, will look for other unsigned and malicious executables in the same directory.

"The problem is that Gatekeeper does not verify that second component," he said.

When he studied Apple's patch, he found that the company had simply blacklisted the Apple-signed code that Wardle had used in his proof-of-concept code. Essentially, the company blacklisted some of its own files.

Apple officials told him that they'd blocked his targeted attack, but Wardle said he pointed out he could simply use different executables to get around the patch.

He said the company has indicated it is working on a more effective patch but he decided to go public anyway since users are still at risk.

The weakness can also be used in a man-in-the-middle attack, especially when software makers do not deliver their installers over SSL/TLS (Secure Sockets Layer/Transport Layer Security).

In a demonstration video, Wardle showed how he could inject malicious code into one application, a Kaspersky antivirus software package, that is not delivered over SSL.

"We're back to square one," he said.

Surprisingly, Wardle found early last year that many security software makers still don't use SSL to deliver their installers. "These guys are supposed to be security professionals," he said.

That means an advanced attacker with network access wouldn't have trouble conducting a man-in-the-middle attack and replicating Wardle's attack.

At Shmoocon, Wardle will release a tool called Ostiarius -- the Latin word for Gatekeeper -- that he says accomplishes what Apple should have done the first time around to fix Gatekeeper.

It monitors all the new processes created in OS X's kernel. If a process isn't digitally signed and comes from a executable that was downloaded from the Internet, it is stopped.

"It's kind of a global approach," Wardle said. "It doesn't care if the executable was run by the user or if an attacker was abusing some signed code to kick that off."

Ostiarius will be posted on Wardle's website, which has a collection of OS X security tools that he's developed.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Featured

Slideshows

The making of an MSSP: a blueprint for growth in NZ

The making of an MSSP: a blueprint for growth in NZ

Partners are actively building out security practices and services to match, yet remain challenged by a lack of guidance in the market. This exclusive Reseller News Roundtable - in association with Sophos - assessed the making of an MSSP, outlining the blueprint for growth and how partners can differentiate in New Zealand.

The making of an MSSP: a blueprint for growth in NZ
Reseller News Platinum Club celebrates leading partners in 2018

Reseller News Platinum Club celebrates leading partners in 2018

The leading players of the New Zealand channel came together to celebrate a year of achievement at the inaugural Reseller News Platinum Club lunch in Auckland. Following the Reseller News Innovation Awards, Platinum Club provides a platform to showcase the top performing partners and start-ups of the past 12 months, with more than ​​50 organisations in the spotlight.​​​

Reseller News Platinum Club celebrates leading partners in 2018
Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP has honoured its leading partners in New Zealand during 2018, following 12 months of growth through the local channel. Unveiled during the fourth running of the ceremony in Auckland, the awards recognise and celebrate excellence, growth, consistency and engagement of standout Kiwi partners.

Meet the top performing HP partners in NZ
Show Comments