Researcher Bypasses Gatekeeper Security Mac OS X

A researcher has managed to circumvent the Gatekeeper security of Mac OS X, making it possible to run unsigned code on systems. Gatekeeper is a security measure since 2012 is present in OS X and determines which applications can run.

For this Gatekeeper performs several checks. By default, Gatekeeper configured to make only apps from the Mac App Store and identified developers allow. In the latter case, it is developers who have a valid Apple Developer ID certificate. Users can also set Gatekeeper to allow only apps or all apps that come from the Mac App Store.

Check

Researchers Patrick Wardle has now found a way to bypass Gatekeeper. The security measure because it does not appear to check whether an app or other apps code loads from the same or a related directory. Gatekeeper trusts the app, on the basis of the first static control. An attacker can abuse this by allowing the user a signed and infected app download or through a third party via a man-in-the-middle position. In this case, the download should take place over HTTP.

In the case of the attack that the investigator has developed, the user will be offered a DMG file. Once the user opens the file, the malicious file is executed in the same DMG file. The problem is present in OS X Yosemite and the beta version of El Capitan, Wardle so late Threat Post know.

Apple is already working on a solution for the short term until a full patch can be deployed. Users get to the appearance of this workaround or patch advised to only download apps via HTTPS and reliable sites such as the Mac App Store. Wardle today gives at the Virus Bulletin conference a presentation about the issue.

Researcher: Most Mac Malware Is Hopelessly Behind

Most malware for Mac OS X is hopelessly behind compared to Windows malware, says researcher Patrick Wardle . "To draw a comparison, it is almost true Windows malware 10 to 15 years ago," so let him opposite Threat Post know. Most specimens Wardle encounter are individual files that are easy to find via the Activity Monitor.

The researcher is concerned about the Mac malware is unknown and unnoticed by the sluggishness of advanced testing tools. Where Windows has advanced and aggressive tools to detect malware, which are not for OS X, allowing sophisticated threats are missed possible. Therefore he will showcase at the upcoming Black Hat conference in Las Vegas how "elegant" Mac malware is making, which can evade anti-malware measures of OS X and third-party security tools.

So Wardle shows how Gatekeeper is remotely bypass to from unsigned code downloaded and run and how to get round all the popular virus scanners and firewalls are simple via malware. However, the investigator concludes with several free security tools that can detect or even prevent advanced Mac malware. "With these tools, we ensure that our computers are better protected against both current and future Mac malware."

Apple Update Shows Root Pipe Leak In OS X Not To Close

Apple released two weeks ago an update for a vulnerability which allows a local attacker root access on Mac OS X could get. Now it appears that the update does not solve the problem, and the latest version of Mac OS X is still vulnerable. The leak did all the necessary controversy.

The vulnerability was namely remedied only by Apple in Mac OS X Yosemite and not in older versions. The Swedish researcher Emil Kvarnhammar also spoke of a backdoor . The problem could certainly since 2011 are present in Apple's operating system. According to researcher Patrick Wardle , it is, however, not yet been resolved.

He discovered his own words a new but simple way in which a local user can use the root pipe leak. Details he shared only with Apple. Through his short message he wants to warn, however, Mac users. He also made demonstration video.