Apple mistakenly approved a widely-used malware to run on Macs

guest · Aug 31, 2020

Apple mistakenly approved a widely-used malware to run on Macs
August 31, 2020
https://techcrunch.com/2020/08/31/apple-notarized-mac-malware/

Apple has some of the strictest rules to prevent malicious software from landing in its app store, even if on occasion a bad app slips through the net. But last year Apple took its toughest approach yet by requiring developers to submit their apps for security checks in order to run on millions of Macs unhindered.

The process, which Apple calls “notarization,” scans an app for security issues and malicious content. If approved, the Mac’s in-built security screening software, Gatekeeper, allows the app to run. Apps that don’t pass the security sniff test are denied, and are blocked from running.
But security researchers say they have found the first Mac malware inadvertently notarized by Apple.
Click to expand...

Peter Dantini working with Patrick Wardle, a well-known Mac security researcher, found a malware campaign disguised as an Adobe Flash installer.
But Dantini and Wardle found that one malicious Flash installer had code notarized by Apple and would run on Macs.

“As far as I know, this is a first,” Wardle wrote in a blog post, shared with TechCrunch.
Wardle said that means Apple did not detect the malicious code when it was submitted and approved it to run on Macs — even on the unreleased beta version of macOS Big Sur, expected out later this year.
Click to expand...

In a statement, a spokesperson for Apple told TechCrunch: “Malicious software constantly changes, and Apple’s notarization system helps us keep malware off the Mac and allow us to respond quickly when it’s discovered. Upon learning of this adware, we revoked the identified variant, disabled the developer account, and revoked the associated certificates. We thank the researchers for their assistance in keeping our users safe.”
Click to expand...

Objective-See (Patrick Wardle): Apple Approved Malware

malicious code ...now notarized!?
It wasn’t too long ago, that Apple’s website stated:

"[Macs] doesn't get PC viruses. A Mac isn’t susceptible to the thousands of viruses plaguing Windows-based computers. That's thanks to built-in defenses in Mac OS X that keep you safe without any work on your part" -Apple.com
The “truth” of this nuanced statement lies in the fact that due to inherent cross-platform incompatibilities (not Apple’s “defenses”): a native Windows virus cannot directly execute on macOS.
Today, malicious code targeting macOS, unfortunately, is far too common.
Click to expand...

Triaging the Payloads
So what are the notarized payloads?
…they appear to be, the rather infamous OSX.Shlayer malware.

OSX.Shlayer is massively common, with Kaspersky noting it may be the most prevalent malware infecting macOS systems: [...]
And what is the ultimate goal of OSX.Shlayer? As noted in my previous analysis of this malware:

"The goal of the malware [OSX.Shlayer] is to download and persistently install various macOS adware." -The Mac Malware of 2018 (OSX.Shlayer)
Click to expand...

Update
As noted, Apple (quickly-ish) revoked the Developer code-signing certificate(s) that were used to sign the malicious payloads. This occurred on Friday, Aug. 28th.
Interestingly, as of Sunday (Aug 30th) the adware campaign was still live and serving up new payloads. Unfortunately these new payloads are (still) notarized: [...]

However the attackers’ ability to agilely continue their attack (with other notarized payloads) is noteworthy. Clearly in the never ending cat & mouse game between the attackers and Apple, the attackers are currently (still) winning.
Click to expand...

Rasheed187 · Aug 31, 2020

LOL, what a major blunder by Apple.

guest · Oct 23, 2020

...again:

Apple notarizes six malicious apps posing as Flash installers
Apple notarization process bypassed for the second time in six weeks
October 23, 2020
https://www.zdnet.com/article/apple-notarizes-six-malicious-apps-posing-as-flash-installers/

Malware authors have managed to pass malicious apps through the Apple app notarization process for the second time this year and the second time in the past six weeks.
FIRST WAVE OF NOTARIZED MALWARE
The first malicious apps that managed to pass through the notarization process and get whitelisted on newer versions of macOS were discovered at the end of August[1, 2].
In total, 40 apps passed through, apps that were infected with the Shlayer trojan and the BundleCore adware.
SECOND WAVE OF NOTARIZED MALWARE
But in a report published this week, Joshua Long, Chief Security Analyst for Mac security software maker Intego, said his company discovered six new apps that passed through the notarization process.

The six notarized apps posed as Flash installers, Long told ZDNet today. Once installed, the apps would download and install the OSX/MacOffers adware.
Click to expand...

Long said the six apps have now been de-notarized.

"Apple revoked the developer certificate while the malware was under investigation, before we had a chance to report it to Apple," Long told us.
"It's unclear how Apple became aware of it; perhaps they might have gotten a report from another researcher investigating the malware, or perhaps from a Mac user who encountered it in the wild."
Click to expand...

Intezer: Apple notarizes new Mac malware… again

For the second time in six weeks, Apple has been caught notarizing Mac malware.
Intego previously reported that Apple inadvertently notarized more than 40 malware samples in August.

This time, rather than the notarized malware belonging to the OSX/Shlayer and OSX/Bundlore families, the latest malware is from the OSX/MacOffers (aka MaxOfferDeal) family.
Click to expand...

Rasheed187 · Oct 24, 2020

LOL, and here is another major blunder from Apple, seems like firewalls like Little Snitch don't work correctly anymore on the new macOS. So much for macOS being more safe than Windows.

https://twitter.com/patrickwardle/status/1318440769154240513

guest · Nov 23, 2020

Apple-Notarized Malware: What It Is and How It Affects Mac Users
November 22, 2020
https://www.tripwire.com/state-of-s...e-notarized-malware-how-it-affects-mac-users/

Malicious actors are targeting Apple. Although Apple introduced a notarization mechanism to scan and prevent malicious code from running on Apple devices, attackers have found ways to circumvent this process. Such Apple-notarized malware constitutes a threat to macOS users.

Let us start by exploring what Apple notarization is. We will then discuss some recent examples of Apple-notarized malware and some prevention techniques.
Click to expand...

Log in or Sign up

Apple mistakenly approved a widely-used malware to run on Macs

guest Guest

Rasheed187 Registered Member

guest Guest

Rasheed187 Registered Member

guest Guest

Log in or Sign up

Apple mistakenly approved a widely-used malware to run on Macs

guest Guest

Rasheed187 Registered Member

guest Guest

Rasheed187 Registered Member

guest Guest

Useful Searches