Security News > 2021 > April > Hackers Exploit 0-Day Gatekeeper Flaw to Attack macOS Computers
"An unsigned, unnotarized, script-based proof of concept application could trivially and reliably sidestep all of macOS's relevant security mechanisms, even on a fully patched M1 macOS system," security researcher Patrick Wardle explained in a write-up.
"Armed with such a capability macOS malware authors could returning to their proven methods of targeting and infecting macOS users."
Apple's macOS comes with a feature called Gatekeeper, which allows only trusted apps to be run by ensuring that the software has been signed by the App Store or by a registered developer and has cleared an automated process called "App notarization" that scans the software for malicious content.
"It's an app in the sense that you can double click it and macOS views it as an app when you right click -> Get Info on the payload," Owens said.
According to macOS security firm Jamf, the threat actor behind Shlayer malware has been abusing this Gatekeeper bypass vulnerability as early as January 9, 2021.
In addition to the aforementioned vulnerability, Monday's updates also address a critical flaw in WebKit Storage that concerns an arbitrary code execution flaw in iOS, macOS, tvOS, and watchOS when processing maliciously crafted web content.
News URL
Related news
- Alert: Adobe Commerce and Magento Stores Under Attack from CosmicSting Exploit (source)
- Critical Ivanti RCE flaw with public exploit now used in attacks (source)
- North Korean Hackers Using New VeilShell Backdoor in Stealthy Cyber Attacks (source)
- Google Adds New Pixel Security Features to Block 2G Exploits and Baseband Attacks (source)
- Microsoft and DOJ disrupt Russian FSB hackers' attack infrastructure (source)
- Iranian hackers now exploit Windows flaw to elevate privileges (source)
- Supply Chain Attacks Can Exploit Entry Points in Python, npm, and Open-Source Ecosystems (source)
- Hackers Exploit Roundcube Webmail XSS Vulnerability to Steal Login Credentials (source)
- macOS HM Surf vuln might already be under exploit by major malware family (source)
- Hackers exploit Roundcube webmail flaw to steal email, credentials (source)