4 ms·

To sum it up: * MacOS automatically registers an application as the default handler for any custom URL schemes it declares, as soon as the app is downloaded (t

To sum it up: * MacOS automatically registers an application as the default handler for any custom URL schemes it declares, as soon as the app is downloaded (this happens automatically when the app hits the hard drive) * Such custom URL schemes linked to malicious app may be opened via javascript automatically on a webpage, leading to the app execution by the system * The system asks for permission to launch the app the first time. The name of the app as displayed in the permission box is app-controlled, so it can spoof its identity or use a cute name with emojis to make it less suspicious (as per the article)

jsjohnst 8y ago
> The system asks for permission to launch the app the first time. Small point, but one I think is important, is you’ll be asked not once, but twice for confirmation. The first confirmation is for the custom url scheme, the second confirmation is for file quarantine for the newly downloaded app. While I think the default of “opening safe files” is utterly bat shit stupid, Apple has done a fair amount here to block this “attack” vector otherwise. It’s asinine to me this “attack” would work on a security minded user as the article indicates the presenter said, but I guess the adage that “everyone makes mistakes sometimes” explains it.
- s-y-n-syn-a-c-k 8y ago
  from the article, "In its default configuration, Gatekeeper allows signed applications. The malware used by the WINDSHIFT APT group was signed (as is most Mac malware these days). So Gatekeeper doesn't even come into play!" So as long as the app is signed, there are no secondary prompts from gatekeeper
  - jsjohnst 8y ago
    Sorry to burst your bubble, but all executable downloads get quarantine dialog. If the binary wasn’t signed, then it wouldn’t be a dialog with a “proceed” equivalent option, it would be a full stop (unless you turned off the requirement).
    - s-y-n-syn-a-c-k 8y ago
      There is no bubble to burst. What you said is untrue in High Sierra and maybe other versions. Go out and download a signed executable. If I download and execute a signed package from the Internet, I receive no warning. If that package installs a URL scheme helper, I always receive "would you like to run xxxxxx" from Safari. The article even says gatekeeper does not come into play with signed apps. So you are refuting the article's accuracy? https://support.apple.com/en-us/HT202491 https://support.apple.com/en-us/HT202491
      - jsjohnst 8y ago
        Quarantine != Gatekeeper. They are two different things, stop conflating them. Even with a signed app, you’ll get the quarantine dialog. See this Apple Support page for confirmation and to see an example: https://support.apple.com/en-us/HT201940 https://support.apple.com/en-us/HT201940

jsjohnst 8y ago

> The system asks for permission to launch the app the first time. Small point, but one I think is important, is you’ll be asked not once, but twice for confirmation. The first confirmation is for the custom url scheme, the second confirmation is for file quarantine for the newly downloaded app. While I think the default of “opening safe files” is utterly bat shit stupid, Apple has done a fair amount here to block this “attack” vector otherwise. It’s asinine to me this “attack” would work on a security minded user as the article indicates the presenter said, but I guess the adage that “everyone makes mistakes sometimes” explains it.

s-y-n-syn-a-c-k 8y ago
from the article, "In its default configuration, Gatekeeper allows signed applications. The malware used by the WINDSHIFT APT group was signed (as is most Mac malware these days). So Gatekeeper doesn't even come into play!" So as long as the app is signed, there are no secondary prompts from gatekeeper
- jsjohnst 8y ago
  Sorry to burst your bubble, but all executable downloads get quarantine dialog. If the binary wasn’t signed, then it wouldn’t be a dialog with a “proceed” equivalent option, it would be a full stop (unless you turned off the requirement).
  - s-y-n-syn-a-c-k 8y ago
    There is no bubble to burst. What you said is untrue in High Sierra and maybe other versions. Go out and download a signed executable. If I download and execute a signed package from the Internet, I receive no warning. If that package installs a URL scheme helper, I always receive "would you like to run xxxxxx" from Safari. The article even says gatekeeper does not come into play with signed apps. So you are refuting the article's accuracy? https://support.apple.com/en-us/HT202491 https://support.apple.com/en-us/HT202491
    - jsjohnst 8y ago
      Quarantine != Gatekeeper. They are two different things, stop conflating them. Even with a signed app, you’ll get the quarantine dialog. See this Apple Support page for confirmation and to see an example: https://support.apple.com/en-us/HT201940 https://support.apple.com/en-us/HT201940