New Mac Malware Exploits GateKeeper Bypass Bug that Apple Left Unpatched

Intego team last week discovered^[1]
four samples of new macOS malware on VirusTotal that leverage the
GateKeeper bypass vulnerability to execute untrusted code on macOS
without displaying users any warning or asking for their explicit
permission.

However, the newly discovered malware, dubbed OSX/Linker,
has not been seen in the wild as of now and appears to be under
development. Though the samples leverage unpatched Gatekeeper
bypass flaw, it does not download any malicious app from the
attacker’s server.

According to Joshua Long from Intego, until last week, the
“malware maker was merely conducting some detection testing
reconnaissance.”

“One of the files was signed with an Apple Developer ID (as
explained below), it is evident that the OSX/Linker disk images are
the handiwork of the developers of the OSX/Surfbuyer adware,” Long
said in a blog post.

However, since the malware sample links to a remote server from
where it downloads the untrusted app, attackers can also distribute
same samples to real targeted by merely replacing the defined
sample app with a malware app on their server.

macOS Gatekeeper Bypass Vulnerability

GateKeeper is a security feature built into Apple macOS that
enforces code signing and verifies downloaded applications before
allowing them to run, helping users protect their systems from
malware and other malicious software.

That means, if you download an application from the Internet,
GateKeeper will only allow it to execute without any warnings if it
has been signed with a valid Apple-issued certificate, otherwise
will prompt you to allow or deny the execution.

However, Gatekeeper has been designed to treat both external drives
(USB or HDD) and network shares as “safe locations” from where
users can run any application without involving GateKeeper’s checks
and prompts.

Filippo Cavallarin, an independent security researcher, late
last month publicly revealed a way
to exploit this behavior by combining it with two other legitimate
features of macOS operating system, which are:
^[2]

zip archives can contain symbolic links pointing to an arbitrary
location, including automount endpoints, and
automount feature on macOS can automatically mount a network share
from a remote server just by accessing it with a “special” path
i.e., beginning with “/net/.”

Once a victim opens the ZIP archive and follows the link, he
will navigate to the attacker-controlled network share that’s
trusted by Gatekeeper, tricking the victim into running malicious
executable files without any warning.

Cavallarin responsibly reported his findings to Apple on
February 22 but decided to go public late last month after the
company failed to patch the issue within the 90 days disclosure
deadline and started ignoring his emails.

Until Apple patches this issue, researcher advised network
administrators to block NFS communications with external IP
addresses, and for home users, it is always important to not open
email attachments from an unknown, suspicious, or untrustworthy
source.