[ad_1]
Apple has addressed a macOS vulnerability that unsigned and unnotarized script-based apps might exploit to bypass all macOS safety safety mechanisms even on totally patched techniques.
In the event that they circumvent automated notarization safety checks (which scans for malicious parts and code-signing points), the functions are allowed to launch by Gatekeeper, a macOS safety function designed to confirm if downloaded apps are notarized and developer-signed.
As soon as malicious script-based apps concentrating on the bypass flaw (CVE-2021-30853) are launched on a goal’s system, they can be utilized by attackers to obtain and deploy second-stage malicious payloads.
Apple has addressed this vulnerability in macOS 11.6 by way of a safety replace launched in September 2021 that provides improved checks.
Gatekeeper bypass with a shebang
The CVE-2021-30853 Gatekeeper bypass bug was found and reported to Apple by Field Offensive Safety Engineer Gordon Lengthy.
He discovered that specially-crafted script-based functions downloaded from the Web would launch with out exhibiting an alert although routinely quarantined.
The “specially-crafted” half requires creating an app that makes use of a script beginning with a shebang (!#) character however leaving the remainder of the road empty, which tells the Unix shell to run the script with out specifying a shell command interpreter.
This results in a Gatekeeper bypass as a result of the syspolicyd daemon routinely generally invoked by the AppleSystemPolicy kernel extension to carry out safety checks (signing and notarization) now not will get triggered for inspection when launching a script with out specifying an interpreter.
Mainly, if the script used a shebang (!#) however didn’t explicitly specify an interpreter, it might bypass Gatekeeper safety checks.
“The syspolicyd daemon will carry out numerous coverage checks and finally stop the execution of untrusted functions, reminiscent of these which can be unsigned or unnotarized,” defined safety researcher Patrick Wardle.
“However, what if the AppleSystemPolicy kext decides that the syspolicyd daemon doesn’t must be invoked? Effectively then, the method is allowed! And if this determination is made incorrectly, effectively then, you’ve got a stunning File Quarantine, Gatekeeper, and notarization bypass.”
As revealed by Wardle, menace actors can exploit this flaw by tricking their targets into opening a malicious app that can be camouflaged as a benign-looking PDF doc.
Such malicious payloads may be delivered on targets’ techniques by way of many strategies, together with poisoned search outcomes, faux updates, and trojaned functions downloaded from websites linking to pirated software program.
Comparable bugs exploited by malware
This isn’t the primary macOS bug fastened by Apple that will allow menace actors to fully circumvent OS safety mechanisms reminiscent of Gatekeeper and File Quarantine on totally patched Macs.
In April, Apple patched a zero-day vulnerability exploited within the wild by Shlayer malware operators to bypass macOS automated safety checks and deploy further payloads on compromised Macs.
The Shlayer menace actors started concentrating on macOS customers with unsigned and unnotarized malware that exploited the zero-day bug (tracked as CVE-2021-30657) beginning with January 2021, because the Jamf Shield detection staff found.
Microsoft additionally found a macOS vulnerability in October, dubbed Shrootless and tracked as CVE-2021-30892), that might be used to bypass System Integrity Safety (SIP) and carry out arbitrary operations, elevate privileges to root, and set up rootkits on compromised units.
“A malicious utility might be able to modify protected components of the file system,” Apple stated in a safety advisory issued after patching the Shrootless bug.
[ad_2]
