All Posts by Date or last 15, 30, 90 or 180 days.
also by Lloyd: diglloyd.com photography and WindInMyFace.com

Thank you for buying via links and ads on this site,
which earn me advertising fees or commissions.
As an Amazon Associate I earn from qualifying purchases.

Other World Computing...
B&H Photo...
Amazon
As an Amazon Associate I earn from qualifying purchases.
Capacities up to 56TB and speeds up to 1527MB/s
877-865-7002
Today’s Deal Zone Items... Handpicked deals...
$1398 $998
SAVE $400

$1798 $1198
SAVE $600

$151 $79
SAVE $72

$2299 $2069
SAVE $230

$240 $120
SAVE $120

$240 $120
SAVE $120

$1399 $749
SAVE $650

$2198 $1998
SAVE $200

$2299 $1799
SAVE $500

$2000 $1500
SAVE $500

$898 $798
SAVE $100

$1799 $1699
SAVE $100

$1699 $1499
SAVE $200

$999 $799
SAVE $200

$1798 $1198
SAVE $600

$1997 $1797
SAVE $200

$3199 $3199
SAVE $click

$80 $33
SAVE $46

$199 $149
SAVE $50

$699 $549
SAVE $150

$400 $300
SAVE $100

$2090 $1690
SAVE $400

$1699 $949
SAVE $750

$1199 $1099
SAVE $100

$1199 $1099
SAVE $100

$999 $949
SAVE $50

$1699 $949
SAVE $750

Apple Core Rot: Apple Notarizes Adware (Malware), Compromises User Systems

Sloppy engineering, irresponsible and negligent quality control practices, and disdain for the needs of working pros are now the hallmark of Apple software

Centralized trust is an inherently bad security design*, but that is how Apple now operates. A single mistake has worldwide implications for hundreds of millions of users. And the notarization process is guaranteed to be fallible.

"The vast majority of threats for macOS in 2019 were in the AdWare category." -Kaspersky

You cannot trust Apple to get system software right, but what can you do when Apple notarizes malware?

* Security that relies on one central authority is kaput should that central authority make a mistake or be compromised. In this case, that authority is Apple. The PGP model of distributed and graduated trust never caught on, but it is far superior and also allows users to build networks of trust—far more resilient.

Apple Approved Malware malicious code ...now notarized!?

We can confirm the payloads are indeed notarized via the spctl command (note the “source=Notarized Developer ID”):

As far as I know, this is a first: malicious code gaining Apple’s notarization “stamp of approval”.

What does this mean?

- These malicious payloads were submitted to Apple, prior to distribution.
- Apple scanned and apparently detecting no malice, (inadvertently) notarized them.
- Now notarized, these malicious payloads are allowed to run—even on macOS Big Sur.
- Again, due to their notarization status, users will (quite likely), fully trust these malicious samples.

To Apple’s credit, once I reported the notarized payloads, they were quick to revoked their certificates (and thus rescind their notarization status): Thus, these malicious payloads will now, no longer run on macOS. Hooray!

...This occurred on Friday, Aug. 28th.

Interestingly, as of Sunday (Aug 30th) the adware campaign was still live and serving up new payloads. Unfortunately these new payloads are (still) notarized:

$ spctl -a -vvv -t install /Volumes/Installer/Installer.app
/Volumes/Installer/Installer.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Aimee Shorter (73KF97486K)

Which means even on Big Sur, they will (still) be allowed to run: Big Sur, prompts, but allows.

If we extract the code-signing time stamp, we can see this (new) payload was signed on Friday PM (Aug 28, 2020 at 1:04:04 PM HST) ...likely after Apple’s initial “response”?

Both the old and “new” payload(s) appears to be nearly identical, containing “OSX.Shlayer” packaged with the “Bundlore” adware.

However the attackers’ ability to agilely continue their attack (with other notarized payloads) is noteworthy. Clearly in the never ending cat & mouse game between the attackers and Apple, the attackers are currently (still) winning.

...

View all handpicked deals...

Sony Alpha a7R II Mirrorless Digital Camera (Body Only)
$1798 $1198
SAVE $600

diglloyd.com | Terms of Use | PRIVACY POLICY
Contact | About Lloyd Chambers | Consulting | Photo Tours
Mailing Lists | RSS Feeds | Twitter
Copyright © 2020 diglloyd Inc, all rights reserved.
Display info: __RETINA_INFO_STATUS__