5 ms·
Isn't this the time when Mac App Store supposed to shine? When they found something that's dodgy and linked to a company that has apps on App Store, can't they
by esusatyo 11y ago
Isn't this the time when Mac App Store supposed to shine? When they found something that's dodgy and linked to a company that has apps on App Store, can't they just turn on the kill switch? That way the malware won't have anywhere to direct the users to.
- glhaynes 11y agoIt's not clear whether this "adware installer" is signed by a developer cert. I'm gonna guess it isn't, which means under the default settings, if a user double-clicks it to execute it, they'll be presented with a message saying that the app can't be run because it's "from an unknown developer" and the current settings disallow it. The user can get around that by right-clicking it and choosing "Open" (or switching Gatekeeper to be more relaxed), but the error message doesn't allude to this. Edit: And if it is signed: yes, I believe Apple could and presumably would push out a malware update that would invalidate the cert.
- noondip 11y agoOne could easily make an "app" which just runs a shell script with this exploit - no code signing needed.
- glhaynes 11y agoAnd users attempting to run it would encounter the things I mentioned above, so I'm not sure what you're getting at.
- noondip 11y agoI'm getting at the fact a shell script with this exploit can be made to look like an "app" and be "double-clickable", and doesn't require any code signing.
- jakobegger 11y agoGatekeeper also watches over shell scripts, so when you double click the shell script it will tell you that you can't open it because it is from an unidentified developer.
- noondip 11y agoYou're thinking of quarantine. You'll get a warning saying the script was downloaded from the Internet, asking if you're sure you want to open it. Again, nothing to do with code signing.
- glhaynes 11y agoI haven't gotten to try it to confirm but I'm having trouble imagining why an unsigned .app bundle containing a binary executable would get the code-signing error but one containing a script wouldn't. Is that in fact the case?
- noondip 11y agoSorry for not making this more clear. Create a shell script with the exploit, then remove the .sh extension. You can edit the icon to make it appear as any application and when double-clicked it will open and run in Terminal.app.
- glhaynes 11y agoAh, thanks for clarifying. I suppose it wouldn't have execute permissions if downloaded from a browser, but it could if copied with Finder from a network share (or directly accessed, of course), so that sounds like a potential vector.
- noondip 11y agoIt is a lot easier than you may think. Here is a simple demonstration: https://vid.me/gGQY https://vid.me/gGQY
- __david__ 11y agoAnything with a .app wrapper needs to be signed. It doesn't matter if the main exe is a binary or a script.
- taspeotis 11y ago> When they found something that's dodgy and linked to a company that has apps on App Store, can't they just turn on the kill switch? That way the malware won't have anywhere to direct the users to. If Apple did this you could take down any app from the App Store by writing some malware and making it "advertise" the App Store listing.