All Posts by Date or last 15, 30, 90 or 180 days.
also by Lloyd: diglloyd.com photography and WindInMyFace.com

Thank you for buying via links and ads on this site,
which earn me advertising fees or commissions.
As an Amazon Associate I earn from qualifying purchases.

Other World Computing...
B&H Photo...
Amazon
As an Amazon Associate I earn from qualifying purchases.
Upgrade the memory of your 2020 iMac up to 128GB
877-865-7002
Today’s Deal Zone Items... Handpicked deals...
$1998 $1798
SAVE $200

$4499 $2999
SAVE $1500

$1799 $1599
SAVE $200

$3498 $2998
SAVE $500

$2198 $1748
SAVE $450

$898 $698
SAVE $200

$2999 $1699
SAVE $1300

$799 $529
SAVE $270

$2397 $2197
SAVE $200

$130 $100
SAVE $30

$2397 $2197
SAVE $200

$1697 $1597
SAVE $100

$2998 $2798
SAVE $200

$2198 $1748
SAVE $450

$1799 $1599
SAVE $200

$2198 $1898
SAVE $300

Apple Core Rot: Apple Notarizes Adware (Malware), Compromises User Systems

Sloppy engineering, irresponsible and negligent quality control practices, and disdain for the needs of working pros are now the hallmark of Apple software

Centralized trust is an inherently bad security design*, but that is how Apple now operates. A single mistake has worldwide implications for hundreds of millions of users. And the notarization process is guaranteed to be fallible.

"The vast majority of threats for macOS in 2019 were in the AdWare category." -Kaspersky

You cannot trust Apple to get system software right, but what can you do when Apple notarizes malware?

* Security that relies on one central authority is kaput should that central authority make a mistake or be compromised. In this case, that authority is Apple. The PGP model of distributed and graduated trust never caught on, but it is far superior and also allows users to build networks of trust—far more resilient.

Apple Approved Malware malicious code ...now notarized!?

We can confirm the payloads are indeed notarized via the spctl command (note the “source=Notarized Developer ID”):

As far as I know, this is a first: malicious code gaining Apple’s notarization “stamp of approval”.

What does this mean?

- These malicious payloads were submitted to Apple, prior to distribution.
- Apple scanned and apparently detecting no malice, (inadvertently) notarized them.
- Now notarized, these malicious payloads are allowed to run—even on macOS Big Sur.
- Again, due to their notarization status, users will (quite likely), fully trust these malicious samples.

To Apple’s credit, once I reported the notarized payloads, they were quick to revoked their certificates (and thus rescind their notarization status): Thus, these malicious payloads will now, no longer run on macOS. Hooray!

...This occurred on Friday, Aug. 28th.

Interestingly, as of Sunday (Aug 30th) the adware campaign was still live and serving up new payloads. Unfortunately these new payloads are (still) notarized:

$ spctl -a -vvv -t install /Volumes/Installer/Installer.app
/Volumes/Installer/Installer.app: accepted
source=Notarized Developer ID
origin=Developer ID Application: Aimee Shorter (73KF97486K)

Which means even on Big Sur, they will (still) be allowed to run: Big Sur, prompts, but allows.

If we extract the code-signing time stamp, we can see this (new) payload was signed on Friday PM (Aug 28, 2020 at 1:04:04 PM HST) ...likely after Apple’s initial “response”?

Both the old and “new” payload(s) appears to be nearly identical, containing “OSX.Shlayer” packaged with the “Bundlore” adware.

However the attackers’ ability to agilely continue their attack (with other notarized payloads) is noteworthy. Clearly in the never ending cat & mouse game between the attackers and Apple, the attackers are currently (still) winning.

...


Deals Updated Daily at B&H Photo
View all handpicked deals...

FUJIFILM GFX 50R Medium Format Mirrorless Camera
$4499 $2999
SAVE $1500

diglloyd.com | Terms of Use | PRIVACY POLICY
Contact | About Lloyd Chambers | Consulting | Photo Tours
Mailing Lists | RSS Feeds | Twitter
Copyright © 2020 diglloyd Inc, all rights reserved.
Display info: __RETINA_INFO_STATUS__