Researcher finds fault in Apple's Gatekeeper patch

Synack's Patrick Wardle says Gatekeeper can still be tricked into letting malware run

Apple hasn't completely fixed a weakness in Gatekeeper, its security technology that blocks harmful applications from being installed.

Patrick Wardle, director of research with the company Synack, said in an interview he reverse-engineered a patch Apple released in October and found it wasn't quite the fix he expected.

Wardle found he could still bypass Gatekeeper and install malware. He's going public with his latest findings on Sunday at the Shmoocon security conference, which starts Friday in Washington, D.C. 

"Releasing a patch claiming it is fixed kind of doesn't solve the problem," Wardle said. "Users will think they're secure when they're not."

Wardle, who has studied OS X extensively, found the original bug that Apple patched, CVE-2015-7024.

When a user downloads an application, Gatekeeper checks if it has a digital signature and blocks those that don't have one approved by Apple.

Wardle found that Gatekeeper only verifies the initial executable that the user double-clicks on. So Wardle found some other code signed by Apple that, when run, will look for other unsigned and malicious executables in the same directory.

"The problem is that Gatekeeper does not verify that second component," he said.

When he studied Apple's patch, he found that the company had simply blacklisted the Apple-signed code that Wardle had used in his proof-of-concept code. Essentially, the company blacklisted some of its own files.

Apple officials told him that they'd blocked his targeted attack, but Wardle said he pointed out he could simply use different executables to get around the patch.

He said the company has indicated it is working on a more effective patch but he decided to go public anyway since users are still at risk.

The weakness can also be used in a man-in-the-middle attack, especially when software makers do not deliver their installers over SSL/TLS (Secure Sockets Layer/Transport Layer Security).

In a demonstration video, Wardle showed how he could inject malicious code into one application, a Kaspersky antivirus software package, that is not delivered over SSL.

"We're back to square one," he said.

Surprisingly, Wardle found early last year that many security software makers still don't use SSL to deliver their installers. "These guys are supposed to be security professionals," he said.

That means an advanced attacker with network access wouldn't have trouble conducting a man-in-the-middle attack and replicating Wardle's attack.

At Shmoocon, Wardle will release a tool called Ostiarius -- the Latin word for Gatekeeper -- that he says accomplishes what Apple should have done the first time around to fix Gatekeeper.

It monitors all the new processes created in OS X's kernel. If a process isn't digitally signed and comes from a executable that was downloaded from the Internet, it is stopped.

"It's kind of a global approach," Wardle said. "It doesn't care if the executable was run by the user or if an attacker was abusing some signed code to kick that off."

Ostiarius will be posted on Wardle's website, which has a collection of OS X security tools that he's developed.

Join the CSO newsletter!

Error: Please check your email address.

More about AppleApple.KasperskyTransport

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jeremy Kirk

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts