Microsoft says a vulnerability it discovered in a core macOS security feature, Gatekeeper, could have allowed attackers to compromise vulnerable Macs with malware.
The flaw, tracked as CVE-2022-42821, was first uncovered by Microsoft principal security researcher Jonathan Bar Or, and dubbed the “Achilles” vulnerability. Bar Or said the bug could allow malware to skirt Gatekeeper’s protections on macOS.
First introduced in 2012, Gatekeeper is a security feature designed to allow only trusted software to run on macOS. The feature automatically verifies that all apps downloaded from the internet are from identified developers who have been “notarized” by Apple, and whose apps are known to be free of malicious content.
Microsoft’s Bar Or explained in a blog post that macOS adds a “quarantine” attribute to apps and files that have been downloaded from a web browser and instructs Gatekeeper to check the file before it can be opened. But the Achilles vulnerability exploits a file permissions model called Access Control Lists (ACLs) to add extremely restrictive permissions to a downloaded file, which prevents web browsers from properly setting the quarantine attribute.
In exploiting the bug, a user could be tricked into downloading and opening a malicious file on macOS without triggering Gatekeeper’s security protections.
Microsoft reported the Achilles flaw in July, but Apple didn’t acknowledge the vulnerability was fixed until last week.
Bar Or said that Lockdown Mode, an opt-in Apple feature introduced earlier this year to help high-risk users block some of the more sophisticated cyberattacks, would not defend against the Achilles vulnerability, since Lockdown Mode is aimed at stopping silent and remotely triggered “zero-click” attacks that require no user interaction. “End-users should apply the fix regardless of their Lockdown Mode status,” said Bar Or.
Achilles is just one of many Gatekeeper bypasses that have been uncovered in recent years. In April 2021, Apple fixed a zero-day vulnerability in macOS that enabled the threat actors behind the notorious Shlayer malware to bypass Apple’s Gatekeeper and notarization security checks.
Last week, the video game giant Riot Games revealed that hackers had compromised its “development environment” — where the company stores its source code — with a social engineering attack. While the company reassured its users that “there is no indication that player data or personal information was obtained,” the hack could still be damaging, as hackers […]
The holiday season is almost over, but security patches are still continuing to arrive thick and fast in December. The month has seen updates released by Apple, Google, and Microsoft, as well as enterprise software companies including the likes of SAP, Citrix, and VMWare. Many of the patches fix zero-day vulnerabilities already being exploited in […]
Cybercriminals are actively exploiting a two-year-old VMware vulnerability as part of a ransomware campaign targeting thousands of organizations worldwide. Reports emerged over the weekend that VMware ESXi servers left vulnerable and unpatched against a remotely exploitable bug from 2021 were compromised and scrambled by a ransomware variant dubbed “ESXiArgs.” ESXi is VMware’s hypervisor, a technology that […]
Leave a Reply