Apple has some of the strictest rules for preventing malicious software from arriving in its app store, even if a faulty app sometimes slips across the network. But Apple took its toughest approach last year, asking developers to submit their apps for security checks in order to run on millions of Macs unhindered.
The process, which Apple calls "notarization," scans an app for security issues and malicious content. If approved, the Mac The integrated security screening software, Gatekeeper, allows the app to run. Apps that fail the security detection test are denied and cannot be run.
But security researchers claim to have found the first Mac malware inadvertently authenticated by Apple.
Peter Dantini in collaboration with Patrick Wardle, a well-known Mac security researcher, found a malware campaign disguised as an Adobe Flash installer. These campaigns are common and have been around for years, although Flash is rarely used these days, and most run non-motorized code, which Macs immediately block when opened.
But Dantini and Wardle found that a malicious Flash installer had Apple-authenticated code and would run on the Mac.
Wardle confirmed that Apple had approved the code used by the popular Shlayer malware, which security company Kaspersky called the "most common threat" Macs faced in 2019. Shlayer is a kind of adware that intercepts encrypted web traffic. even from HTTPS-enabled sites - and replaces websites and search results with its own ads, making fraudulent advertising money for operators.
"As far as I know, this is the first time," Wardle wrote in a blog post, shared with ProWellTech.
Wardle said this means Apple did not detect the malicious code when it was submitted and approved it to run on Mac, even on the unreleased beta of macOS Big Sur, expected later this year.
Apple revoked the authenticated payloads after Wardle contacted, preventing the malware from running on Macs in the future.
In a statement, an Apple spokesperson told ProWellTech: "Malicious software is constantly changing and Apple's notarization system helps us keep malware away from the Mac and allows us to respond quickly when it is discovered. Upon learning of this adware, we revoked the identified variant, disabled the developer account, and revoked the associated certificates. We thank the researchers for their assistance in keeping our users safe. "
But Wardle said the attackers returned soon after with a new authenticated payload, capable of bypassing Mac security again.