6 ms·
It's not clear whether this "adware installer" is signed by a developer cert. I'm gonna guess it isn't, which means under the default settings, if a user double
by glhaynes 11y ago
It's not clear whether this "adware installer" is signed by a developer cert. I'm gonna guess it isn't, which means under the default settings, if a user double-clicks it to execute it, they'll be presented with a message saying that the app can't be run because it's "from an unknown developer" and the current settings disallow it. The user can get around that by right-clicking it and choosing "Open" (or switching Gatekeeper to be more relaxed), but the error message doesn't allude to this.
Edit: And if it is signed: yes, I believe Apple could and presumably would push out a malware update that would invalidate the cert.
- noondip 11y agoOne could easily make an "app" which just runs a shell script with this exploit - no code signing needed.
- glhaynes 11y agoAnd users attempting to run it would encounter the things I mentioned above, so I'm not sure what you're getting at.
- noondip 11y agoI'm getting at the fact a shell script with this exploit can be made to look like an "app" and be "double-clickable", and doesn't require any code signing.
- jakobegger 11y agoGatekeeper also watches over shell scripts, so when you double click the shell script it will tell you that you can't open it because it is from an unidentified developer.
- noondip 11y agoYou're thinking of quarantine. You'll get a warning saying the script was downloaded from the Internet, asking if you're sure you want to open it. Again, nothing to do with code signing.
- glhaynes 11y agoI haven't gotten to try it to confirm but I'm having trouble imagining why an unsigned .app bundle containing a binary executable would get the code-signing error but one containing a script wouldn't. Is that in fact the case?
- noondip 11y agoSorry for not making this more clear. Create a shell script with the exploit, then remove the .sh extension. You can edit the icon to make it appear as any application and when double-clicked it will open and run in Terminal.app.
- glhaynes 11y agoAh, thanks for clarifying. I suppose it wouldn't have execute permissions if downloaded from a browser, but it could if copied with Finder from a network share (or directly accessed, of course), so that sounds like a potential vector.
- noondip 11y agoIt is a lot easier than you may think. Here is a simple demonstration: https://vid.me/gGQY https://vid.me/gGQY
- glhaynes 11y agoOh, yeah, I should've thought about dmgs. Yikes... that seems "not OK"; but if they made shell scripts require signing I imagine that'd probably break lots of stuff.
- 11y ago
- __david__ 11y agoAnything with a .app wrapper needs to be signed. It doesn't matter if the main exe is a binary or a script.