Apple Issues Patch for Critical Anti-Malware Bypass Flaw

The zero-day flaw exists in MacOS where it can bypass anti-malware functions put in place and would allow an attacker to craft a payload which would not be detected by the security features designed to keep malware out.

Cedric Owens, a security researcher who first discovered the vulnerability said that “this payload can be used in phishing and all the victim has to do is double-click to open the .dmg and double-click the fake app inside of the .dmg–no pop ups or warnings from macOS are generated.”

The flaw works by bypassing three key anti-malware detections – File Quarantine, Gatekeeper and Notarization. File Quarantine provides the first warning to users that requires confirmation before allowing a recently downloaded file to execute. Since users kept ignoring the warnings and subsequently letting malware pass through, Gatekeeper was introduced which checks the code-signing information of downloaded files and will then block those that do not meet system policies. Notarization is the newest feature which ensures that downloaded files have been scanned and approved before it will be allowed to run.