Apple Mac users are being urged to update to macOS Big Sur 11.3, released today, which patches a 'massively bad' vulnerability that could allow malware to bypass layered protections built into the operating system.
The bug was uncovered by security researcher Cedric Owens, who reported it to Apple.
Once he identified how the bug works, Wardle asked researchers from Mac security company Jamf to see if anyone had already exploited it in the wild. Turns out, a variant of malware already quite. IST 04:57 pm: With the macOS Big Sur update 11.2.2, the reliability of Bluetooth has been improved and some problems have been fixed including one related to external displays that led to a black screen when connected to a Mac mini (M1, 2020) using an HDMI to DVI converter.
In a long technical blog post, fellow security researcher Patrick Wardle said the bug 'trivially bypasses many core Apple security mechanisms, leaving Mac users at grave risk' and that 'malware authors are already exploiting it in the wild as an 0day'.
The bug was given the common vulnerabilities and exposures (CVE) reference CVE-2021-30657 in Apple security notes, where it is described as a 'logic issue' that could allow 'a malicious application [to] bypass Gatekeeper checks'.
Gatekeeper was introduced in OSX Lion (10.7) as an added layer of protection when users downloaded executables from the internet.
- Solving Mac OS 8's Y2K20 Bug Macs weren't affected by the infamous Y2K bug, but Low End Mac reports that Mac OS 8 and earlier do suffer from another date-based issue: the Date & Time Control Panel won't accept dates past.
- Andrea Piacquadio / Pexels If your Apple laptop or computer is running the latest version of its operating system, you may have found yourself unable to turn off the Do Not Disturb function.
- MacOS 11 Big Sur introduced a lot of improvements to the Mac's operating system, prompting the majority of Mac users to upgrade immediately as soon as it was released. But like all other new macOS versions, Big Sur comes with its own set of bugs and performance troubles.
It is one of three such protections built into macOS, all of which are intended to alert users about files downloaded from the internet, and to prevent malware writers from tricking users into infecting their machines.
However, Wardle noted, the bug discovered by Owens allowed an attacker 'to trivially and reliably bypass all of these foundational mitigations', without generating any system prompts that would warn the user something was amiss.
Big Mac Cost 2021
A proof-of-concept showed an app could be disguised as a document and 'allowed to launch with no prompts nor alerts'.
'Since 2007, Apple has sought to protect users from inadvertently infecting themselves if they are tricked into running such malicious code. This is a good thing as sure, users may be naive, but anybody can make mistakes,' Wardle wrote.
'Unfortunately due to subtle logic flaw in macOS, such security mechanisms were proven fully and 100 percent moot, and as such we're basically back to square one.
'We started with an unsigned, unnotarised, script-based proof-of-concept application that could trivially and reliably sidestep all of macOS's relevant security mechanisms (File Quarantine, Gatekeeper, and Notarization requirements) …even on a fully patched M1 macOS system.
'Armed with such a capability macOS malware authors could (and are) returning to their proven methods of targeting and infecting macOS users.'
Mac security firm Jamf said in a separate blog post that it had located Shlayer malware already exploiting the bug.
'To make the situation more urgent, the Jamf Protect detections team observed this exploit being used in the wild by a variant of the Shlayer adware dropper,' it said.
'The variant has been repackaged to use a format necessary for carrying out the Gatekeeper bypass vulnerability.
'The Jamf Protect detection team identified samples found to be abusing this vulnerability as early as January 9, 2021.
'Shlayer continues to reintroduce itself with innovative ways to infect macOS-based systems.'
Jamf said that when malware exploiting the bug is launched on computers running Big Sur 11.3, 'the user will see a pop-up message stating that the software ‘cannot be opened because the developer cannot be identified.'
'Since the malicious application is not notarised or signed with a valid developer's certificate, the message will prompt the user to eject the mounted DMG containing the app bundle,' it added.
Owens praised Apple's quick response to patching the flaw.
'Kudos to Apple for rolling out a fix in Big Sur 11.3 beta 6 literally five days after I reported to them,' he wrote.
'The product security team at Apple was very responsive anytime I reached out with an inquiry.
Master telegrapher mac os. 'I highly encourage you to update to Big Sur 11.3 soonest, as the fix has been applied .. so that Gatekeeper now properly blocks this payload on macOS 11.3.'
Apple Mac users are being urged to update to macOS Big Sur 11.3, released today, which patches a 'massively bad' vulnerability that could allow malware to bypass layered protections built into the operating system.
The bug was uncovered by security researcher Cedric Owens, who reported it to Apple.
In a long technical blog post, fellow security researcher Patrick Wardle said the bug 'trivially bypasses many core Apple security mechanisms, leaving Mac users at grave risk' and that 'malware authors are already exploiting it in the wild as an 0day'.
Big Mac Sauce Homemade
The bug was given the common vulnerabilities and exposures (CVE) reference CVE-2021-30657 in Apple security notes, where it is described as a 'logic issue' that could allow 'a malicious application [to] bypass Gatekeeper checks'.
Gatekeeper was introduced in OSX Lion (10.7) as an added layer of protection when users downloaded executables from the internet.
It is one of three such protections built into macOS, all of which are intended to alert users about files downloaded from the internet, and to prevent malware writers from tricking users into infecting their machines.
However, Wardle noted, the bug discovered by Owens allowed an attacker 'to trivially and reliably bypass all of these foundational mitigations', without generating any system prompts that would warn the user something was amiss.
A proof-of-concept showed an app could be disguised as a document and 'allowed to launch with no prompts nor alerts'.
'Since 2007, Apple has sought to protect users from inadvertently infecting themselves if they are tricked into running such malicious code. This is a good thing as sure, users may be naive, but anybody can make mistakes,' Wardle wrote.
'Unfortunately due to subtle logic flaw in macOS, such security mechanisms were proven fully and 100 percent moot, and as such we're basically back to square one.
'We started with an unsigned, unnotarised, script-based proof-of-concept application that could trivially and reliably sidestep all of macOS's relevant security mechanisms (File Quarantine, Gatekeeper, and Notarization requirements) …even on a fully patched M1 macOS system.
'Armed with such a capability macOS malware authors could (and are) returning to their proven methods of targeting and infecting macOS users.'
Mac security firm Jamf said in a separate blog post that it had located Shlayer malware already exploiting the bug.
'To make the situation more urgent, the Jamf Protect detections team observed this exploit being used in the wild by a variant of the Shlayer adware dropper,' it said.
'The variant has been repackaged to use a format necessary for carrying out the Gatekeeper bypass vulnerability.
'The Jamf Protect detection team identified samples found to be abusing this vulnerability as early as January 9, 2021.
'Shlayer continues to reintroduce itself with innovative ways to infect macOS-based systems.'
Jamf said that when malware exploiting the bug is launched on computers running Big Sur 11.3, 'the user will see a pop-up message stating that the software ‘cannot be opened because the developer cannot be identified.'
'Since the malicious application is not notarised or signed with a valid developer's certificate, the message will prompt the user to eject the mounted DMG containing the app bundle,' it added.
Owens praised Apple's quick response to patching the flaw.
'Kudos to Apple for rolling out a fix in Big Sur 11.3 beta 6 literally five days after I reported to them,' he wrote.
'The product security team at Apple was very responsive anytime I reached out with an inquiry.
Big Mac Sauce
'I highly encourage you to update to Big Sur 11.3 soonest, as the fix has been applied .. so that Gatekeeper now properly blocks this payload on macOS 11.3.'
