macOS Gatekeeper Flaw Lets Attackers Swap Downloaded Apps with Malicious Twins
Researchers discovered a vulnerability in Apple macOS Gatekeeper that allows downloaded applications to be replaced with malicious versions after initial execution, bypassing security checks.
Security researchers Talal Haj Bakry and Tommy Mysk have uncovered a significant flaw in Apple's macOS Gatekeeper security mechanism, which allows downloaded applications to be silently replaced with malicious versions. This bypass of Gatekeeper's protections, designed to verify the integrity and authenticity of software from outside the App Store, could put users at risk.
The attack vector requires an attacker to have a means of user-level code execution, meaning it's not a zero-click vulnerability. However, once this initial access is gained, the attacker can exploit a weakness in how macOS handles archived application bundles. The vulnerability specifically affects applications downloaded from the web that have been run at least once, allowing Gatekeeper to perform its initial validation.
According to the researchers, the exploit involves archiving a downloaded, once-run application using a utility like tar. The original application bundle can then be removed and replaced with a malicious version. Crucially, macOS does not prompt for reauthorization or re-validate the application's integrity after this replacement, effectively allowing the malicious version to run undetected by Gatekeeper.
This technique is not applicable to applications downloaded from the Mac App Store, as those are owned by the root user and cannot be overwritten by processes running with current user privileges. However, popular applications downloaded directly from the web, such as Brave, Slack, Signal, or Visual Studio Code, are potentially vulnerable.
Mysk speculated that the issue might stem from cached trust values. "When you open the app for the first time and it passes all validation checks, macOS marks the app as trusted and saves this data," he explained. "Later when I modify the executable, macOS detects a change in the bundle and tries to revalidate its integrity. It seems the cached value of the trust causes macOS to pass the validation even though the bundle has changed."
The researchers demonstrated that once a malicious doppelganger app is in place, it can be used to present deceptive prompts that users are more likely to trust, potentially leading to further compromise, such as access to sensitive data or credentials.
When presented with these findings, Apple reportedly closed the issue, classifying it as a scenario involving locally built app bundles, which are not subject to the same macOS guards as downloaded software. The company considers the social engineering required to trick users into accepting prompts for access to protected resources as outside their security scope.
This discovery highlights a potential gap in macOS's defenses for applications obtained outside the curated App Store, emphasizing the need for users to remain vigilant about the software they download and execute, even after initial security checks have passed.