Researcher finds fault in Apple's Gatekeeper patch

Synack's Patrick Wardle says Gatekeeper can still be tricked into letting malware run

Apple hasn't completely fixed a weakness in Gatekeeper, its security technology that blocks harmful applications from being installed.

Patrick Wardle, director of research with the company Synack, said in an interview he reverse-engineered a patch Apple released in October and found it wasn't quite the fix he expected.

Wardle found he could still bypass Gatekeeper and install malware. He's going public with his latest findings on Sunday at the Shmoocon security conference, which starts Friday in Washington, D.C. 

"Releasing a patch claiming it is fixed kind of doesn't solve the problem," Wardle said. "Users will think they're secure when they're not."

Wardle, who has studied OS X extensively, found the original bug that Apple patched, CVE-2015-7024.

When a user downloads an application, Gatekeeper checks if it has a digital signature and blocks those that don't have one approved by Apple.

Wardle found that Gatekeeper only verifies the initial executable that the user double-clicks on. So Wardle found some other code signed by Apple that, when run, will look for other unsigned and malicious executables in the same directory.

"The problem is that Gatekeeper does not verify that second component," he said.

When he studied Apple's patch, he found that the company had simply blacklisted the Apple-signed code that Wardle had used in his proof-of-concept code. Essentially, the company blacklisted some of its own files.

Apple officials told him that they'd blocked his targeted attack, but Wardle said he pointed out he could simply use different executables to get around the patch.

He said the company has indicated it is working on a more effective patch but he decided to go public anyway since users are still at risk.

The weakness can also be used in a man-in-the-middle attack, especially when software makers do not deliver their installers over SSL/TLS (Secure Sockets Layer/Transport Layer Security).

In a demonstration video, Wardle showed how he could inject malicious code into one application, a Kaspersky antivirus software package, that is not delivered over SSL.

"We're back to square one," he said.

Surprisingly, Wardle found early last year that many security software makers still don't use SSL to deliver their installers. "These guys are supposed to be security professionals," he said.

That means an advanced attacker with network access wouldn't have trouble conducting a man-in-the-middle attack and replicating Wardle's attack.

At Shmoocon, Wardle will release a tool called Ostiarius -- the Latin word for Gatekeeper -- that he says accomplishes what Apple should have done the first time around to fix Gatekeeper.

It monitors all the new processes created in OS X's kernel. If a process isn't digitally signed and comes from a executable that was downloaded from the Internet, it is stopped.

"It's kind of a global approach," Wardle said. "It doesn't care if the executable was run by the user or if an attacker was abusing some signed code to kick that off."

Ostiarius will be posted on Wardle's website, which has a collection of OS X security tools that he's developed.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Essentials

Mobile

Exec

Sony WH-1000XM4 Wireless Noise Cancelling Headphones

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?