Security researchers have identified a vulnerability in macOS that permits attackers to replace legitimate applications with malicious versions without requiring elevated privileges or user passwords. This flaw affects applications downloaded from the web, excluding those obtained through the Mac App Store.
The exploit leverages a peculiar behavior in macOS when handling application bundles archived using the `tar` utility. Typically, macOS applications are signed by developers, and upon their first launch, the system’s Gatekeeper performs a verification. Once an app passes this initial check, subsequent modifications to its contents are blocked, even with administrative privileges.
However, researchers discovered that by archiving an `.app` bundle with `tar`, deleting the original, and then extracting the archive back to its original location, the system allows the application to launch without re-verifying its integrity. This oversight enables attackers to modify the app’s contents freely without triggering security prompts or requiring user consent.
In a proof-of-concept demonstration, the researchers replaced the main executable of a trusted application with a malicious one. When the altered app was launched, it appeared identical to the legitimate version. If the app requested permissions, such as access to files or the camera, the system displayed genuine prompts, making it challenging for users to detect the substitution.
It’s important to note that this vulnerability requires the attacker to have prior code execution capabilities on the target system, which could be achieved through other malicious software or scripts. Additionally, the exploit does not affect applications installed via the Mac App Store, as they are subject to stricter security measures.
Upon reporting the issue to Apple, the company assessed the behavior and determined that it did not necessitate a security fix. This decision has raised concerns within the security community, given the potential risks associated with the vulnerability.
This discovery underscores the importance of vigilance when downloading and installing applications from the web. Users are advised to obtain software exclusively from trusted sources, such as the Mac App Store, and to be cautious of any unexpected behavior in their applications. As attackers continually seek new methods to exploit system vulnerabilities, staying informed and adopting best security practices remain crucial in safeguarding personal and organizational data.
