All Posts by Date or last 15, 30, 90 or 180 days.
also by Lloyd: photography and

Thank you for buying via links and ads on this site,
which earn me advertising fees or commissions.
As an Amazon Associate I earn from qualifying purchases.

Other World Computing...
B&H Photo...
As an Amazon Associate I earn from qualifying purchases.
Upgrade the memory of your 2018 Mac mini up to 64GB
Today’s Deal Zone Items... Handpicked deals...
$3049 $2399
SAVE $650

$3508 $2998
SAVE $510

$998 $848
SAVE $150

$3999 $2998
SAVE $1001

$2299 $1799
SAVE $500

$1597 $1297
SAVE $300

$80 $33
SAVE $46

$2299 $1799
SAVE $500

$1898 $1498
SAVE $400

$2799 $2299
SAVE $500

$2299 $1799
SAVE $500

$600 $400
SAVE $200

$240 $175
SAVE $65

$699 $499
SAVE $200

$400 $300
SAVE $100

$1599 $1398
SAVE $201

$2027 $1597
SAVE $430

$1699 $999
SAVE $700

$180 $100
SAVE $80

$1199 $1099
SAVE $100

$1199 $1099
SAVE $100

$999 $949
SAVE $50

$400 $300
SAVE $100

$1699 $999
SAVE $700

Apple Core Rot: Apple Notarizes Adware (Malware), Compromises User Systems

Sloppy engineering, irresponsible and negligent quality control practices, and disdain for the needs of working pros are now the hallmark of Apple software

Centralized trust is an inherently bad security design*, but that is how Apple now operates. A single mistake has worldwide implications for hundreds of millions of users. And the notarization process is guaranteed to be fallible.

"The vast majority of threats for macOS in 2019 were in the AdWare category." -Kaspersky

You cannot trust Apple to get system software right, but what can you do when Apple notarizes malware?

* Security that relies on one central authority is kaput should that central authority make a mistake or be compromised. In this case, that authority is Apple. The PGP model of distributed and graduated trust never caught on, but it is far superior and also allows users to build networks of trust—far more resilient.

Apple Approved Malware malicious code notarized!?

We can confirm the payloads are indeed notarized via the spctl command (note the “source=Notarized Developer ID”):

As far as I know, this is a first: malicious code gaining Apple’s notarization “stamp of approval”.

What does this mean?

- These malicious payloads were submitted to Apple, prior to distribution.
- Apple scanned and apparently detecting no malice, (inadvertently) notarized them.
- Now notarized, these malicious payloads are allowed to run—even on macOS Big Sur.
- Again, due to their notarization status, users will (quite likely), fully trust these malicious samples.

To Apple’s credit, once I reported the notarized payloads, they were quick to revoked their certificates (and thus rescind their notarization status): Thus, these malicious payloads will now, no longer run on macOS. Hooray!

...This occurred on Friday, Aug. 28th.

Interestingly, as of Sunday (Aug 30th) the adware campaign was still live and serving up new payloads. Unfortunately these new payloads are (still) notarized:

$ spctl -a -vvv -t install /Volumes/Installer/
/Volumes/Installer/ accepted
source=Notarized Developer ID
origin=Developer ID Application: Aimee Shorter (73KF97486K)

Which means even on Big Sur, they will (still) be allowed to run: Big Sur, prompts, but allows.

If we extract the code-signing time stamp, we can see this (new) payload was signed on Friday PM (Aug 28, 2020 at 1:04:04 PM HST) ...likely after Apple’s initial “response”?

Both the old and “new” payload(s) appears to be nearly identical, containing “OSX.Shlayer” packaged with the “Bundlore” adware.

However the attackers’ ability to agilely continue their attack (with other notarized payloads) is noteworthy. Clearly in the never ending cat & mouse game between the attackers and Apple, the attackers are currently (still) winning.


OWC Accelsior 4M2 PCIe SSD
6000 MB/sec!
Mac or PC.

Ideal for Lightroom, Photoshop, video.
Capacity up to 16TB!
OWC Thunderblade Thunderbolt 3 SSD

Blazing fast, up to 16TB.


√ No more slow and noisy hard drives!

Save the tax, we pay you back, instantly! | Terms of Use | PRIVACY POLICY
Contact | About Lloyd Chambers | Consulting | Photo Tours
Mailing Lists | RSS Feeds | Twitter
Copyright © 2020 diglloyd Inc, all rights reserved.
Display info: __RETINA_INFO_STATUS__