TECHCRUNCH 2017 OSX BUG UPDATE
TECHCRUNCH 2017 OSX BUG CODE
TECHCRUNCH 2017 OSX BUG MAC

вЂњOne of our detections alerted us to this new variant, and upon closer inspection we discovered its use of this bypass to allow it to be installed without an end user prompt.

Shlayer is known to be one of the most abundant pieces of malware on macOS so weвЂ™ve developed a variety of detections for its many variants, and we closely track its evolution,вЂќ Bradley told TechCrunch. вЂњThe malware we uncovered using this technique is an updated version of Shlayer, a family of malware that was first discovered in 2018. Jamf also published a technical blog post about the malware. Jamf detections lead Jaron Bradley confirmed that a sample of the Shlayer malware family exploiting the bug was captured in early January, several months prior to OwensвЂ™ discovery.

TECHCRUNCH 2017 OSX BUG MAC

With knowledge of how the bug works, Wardle asked Mac security company Jamf to see if there was any evidence that the bug had been exploited prior to OwensвЂ™ discovery.

TECHCRUNCH 2017 OSX BUG UPDATE

вЂњThe update will now result in the correct classification of applications as bundles and ensure that untrusted, unnotarized applications will (yet again) be blocked, and thus the user protected,вЂќ he told TechCrunch. Wardle described the bug as rendering macOSвЂ™ security features as вЂњwholly moot.вЂќ He confirmed that AppleвЂ™s security updates have fixed the bug.

TECHCRUNCH 2017 OSX BUG CODE

But Owens found that taking out this property file and building the bundle with a particular structure could trick macOS into opening the bundle - and running the code inside - without triggering any warnings. In simple terms, macOS apps arenвЂ™t a single file but a bundle of different files that the app needs to work, including a property list file that tells the application where the files it depends on are located.

The bug meant that macOS was misclassifying certain app bundles and skipping security checks, allowing OwensвЂ™ proof-of-concept app to run unimpeded.

In a technical blog postВ today, Wardle explained that the vulnerability triggers due to a logic bug in macOSвЂ™ underlying code. Owens asked Mac security researcher Patrick Wardle to investigate how - and why - the bug works. Apple also patched earlier macOS versions to prevent abuse, and pushed out updated rules to XProtect, macOSвЂ™ in-built anti-malware engine, to block malware from exploiting the vulnerability. (Image: supplied)ДЇearing the potential for attackers to abuse this vulnerability, Owens reported the bug to Apple.ДЄpple told TechCrunch it fixed the bug in macOS 11.3. The proof-of-concept app disguised as a harmless document running on an unpatched macOS machine. But a malicious attacker could exploit this vulnerability to remotely access a userвЂ™s sensitive data simply by tricking a victim into opening a spoofed document, he explained. Owens built a proof-of-concept app disguised as a harmless document that exploits the bug to launch the Calculator app, a way of demonstrating that the bug works without dropping malware.

вЂњAll the user would need to do is double click - and no macOS prompts or warnings are generated,вЂќ he told TechCrunch. Owens told TechCrunch that the bugВ allowed him to build a potentially malicious app to look like a harmless document, which when opened bypasses macOSвЂ™ built-in defenses when opened. And if macOS hasnвЂ™t reviewed the app - a process Apple calls notarization - or if it doesnвЂ™t recognize its developer, the app wonвЂ™t be allowed to run without user intervention.Д«ut security researcher Cedric Owens said the bug he found in mid-March bypasses those checks and allows a malicious app to run. Indeed, macOS flags potentially malicious apps masquerading as documents that have been downloaded from the internet. Over the years, Macs have adapted to catch the most common types of malware by putting technical obstacles in their way. Worse, evidence shows a notorious family of Mac malware had been exploiting this vulnerability for months before it was subsequently patched by Apple this week. Apple has spent years reinforcing macOS with new security features to make it tougher for malware to break in.В But a newly discovered vulnerability broke through most of macOSвЂ™ newer security protections with a double-click of a malicious app, a feat not meant to be allowed under AppleвЂ™s watch.

Techcrunch 2017 osx bug