Researchers Discover Method to Bypass macOS Security for Malware Execution
Researchers have identified a new method to bypass Apple's macOS security mechanisms and run malware. However, exploiting this method requires several conditions to be met.
Security researchers Talal Haj Bakry and Tommy Mysk have uncovered a vulnerability in Apple's macOS that allows malware to be executed by silently replacing trusted application executables. The method does not require elevated privileges and bypasses security warnings.
The attack, however, has a relatively high barrier to entry. It requires that a user has already downloaded and installed an application on their Mac, run it at least once, and that the attacker has obtained physical or remote access to the target Mac. Applications downloaded from the Mac App Store are not affected by this particular vulnerability.
According to the researchers' findings, an attacker can archive a downloaded application, replace the original executable with malicious code, and then unpack the archive. The macOS system will still recognize the application as trusted, and its Gatekeeper security check will not be triggered. When the application is relaunch, it will execute the attacker's code without raising any security alerts.
Since macOS typically prompts for administrative credentials using its native dialog boxes, and the application is already considered trusted by the user, individuals are more likely to provide their passwords. The researchers also noted that the malicious code can restore the original executable after its execution, effectively erasing traces of the tampering. These findings highlight the importance of user vigilance regarding application sources and the ongoing need for robust security measures.