Security researchers have identified a method to replace legitimate macOS applications downloaded from the internet with malicious versions, even after Apple's Gatekeeper security feature has initially validated them. This technique, detailed by Talal Haj Bakry and Tommy Mysk, exploits a gap in Gatekeeper and associated code signing protocols, allowing an attacker to silently substitute an application's main executable without requiring elevated privileges.
Gatekeeper is designed to verify that software from outside the App Store originates from an identified developer, has been notarized by Apple as free of known malicious content, and has not been altered. However, the researchers demonstrated that once a web-downloaded macOS application has been run at least once, an attacker with user-level code execution capabilities can archive the application bundle, delete the original, and replace it with a malicious version. macOS then fails to re-authenticate the modified application.
This vulnerability does not affect applications downloaded from the Mac App Store, as these are owned by the root user, preventing modification by processes running with current user privileges. However, many popular applications downloaded directly from the web, such as Brave, Slack, Signal, and Visual Studio Code, could be susceptible.
The attack scenario requires an initial execution of the legitimate, web-downloaded application to allow Gatekeeper to complete its first validation. Subsequently, an attacker needs a means to execute user-scoped code, which could be achieved through various methods including malicious scripts, command-line tools, or supply chain attacks via package managers like npm or Homebrew. Once a malicious doppelganger app is in place, it could present deceptive prompts that users might trust, believing they originate from a legitimate application.
The researchers speculate that the issue might stem from cached trust values. After an application passes initial validation, macOS marks it as trusted and saves this data. When the executable is later modified, macOS attempts to revalidate its integrity, but the cached trust value appears to cause the validation to pass despite the bundle having changed.
Bakry and Mysk reported their findings to Apple. According to the researchers, Apple closed the issue, stating that the archiving and restoring process overwrites the entire application bundle, effectively making it a "locally built" application. Apple's position is that locally built app bundles are not covered by macOS security guards, and that any subsequent prompts for system authorization (e.g., access to Keychain or TCC-protected directories) would be a matter of social engineering, which Apple considers outside the scope of this particular security concern.
