12 ms·
Apple Accidentally Approved Malware to Run on macOS
- jibcage 6y agoSince the whole point of notarization is to give Apple the power to revoke malicious binaries on its system after-the-fact, this seems like it works by design, no? Apple quickly revoked the notarization once they were alerted of the malware. Otherwise Apple would have to scan every single binary submitted for notarization, which then puts a pretty large onus on them should anything slip through.
- Karliss 6y agoIf Apple didn't want scan every binary submitted for notarization then they didn't need to introduce the notarization. They already had the means to revoke malicious binaries after-the-fact by revoking the corresponding developer certificate. The main difference with notarization is that it forces binaries to be submitted to Apple early for inspection in comparison with signing using developer certificate which happens locally.
- natcombs 6y agoWouldn’t you also want the ability to revoke just certain binaries? Let’s say a large company like Microsoft accidentally somehow got malware on their Excel app, you wouldn’t want to terminate the dev cert because that would also cancel Outlook, Word, PowerPoint, etc
- flohofwoe 6y agoIf I'm not mistaken you can create as many code signing certificates as you want, so it makes sense to sign each application with its own certificate. Of course this wouldn't help when Apple "kills" the entire developer account I guess.
- judge2020 6y agoNope, you can only generate 5 Developer ID Application certificates for the lifetime of your Developer account. It's a real pain to get another one, I had lost all of mine (didn't have a real Mac, so was using various temporary Hackintosh and KVM installs) and it took 2 months of emails to both Developer support and the Security team to get another one issued [and backed up].
- EricE 6y agoIt took you five times before you learned to make backups? Woah.
- captainredbeard 6y agoThat's a bit condescending. The signing stack is very complicated and folks often make mistakes when attempting to back up (export) the correct private key and certificate pair.
- judge2020 6y agoI admit it was foolish, but this was over 3 years and I didn't know there was a limit on the number of certificates you could generate.
- 0x0 6y agoThat's what XProtect is for
- grishka 6y agoMoreover, they've had the ability to "revoke binaries" before notarization was a thing. There's a small antivirus scanner that runs on every app you download and on every dmg you mount, and shows a very scary warning if it detects known malware.
- captainredbeard 6y ago> They already had the means to revoke malicious binaries after-the-fact by revoking the corresponding developer certificate That's a big hammer because it breaks everything that was ever signed with the certificate.
- mullingitover 6y agoThat's fine with me - if the developer was caught with one malware-infected app, I would worry about the other malware they shipped that wasn't caught.
- _qulr 6y agoNot true. They can make the certificate invalid after a certain date, while still allowing software signed before that date. This happened when Panic lost their signing certificate.
- nicky0 6y agoApple actually does claim to scan every submitted binary for "malicious content", among other things.[1] 1: https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution https://developer.apple.com/documentation/xcode/notarizing_m...
- simondotau 6y agoI'm confused, when did Apple "approve" anything? The notarisation software isn't a review process.
- flohofwoe 6y agoWhat else is the scanning of an uploaded executable than an (automated) review process though? The notarization process wouldn't be needed to implement a "kill-switch" for executables by revoking the certificate (code signing with an Apple certificate was required long before notarization). If anything, the notarization creates an illusion of security for the user which might be worse than an unsigned executable (because at least an unsigned exe looks shady right from the start, but a notarized exe had been scanned by Apple so it's ok to run, right?)
- coldtea 6y ago>What else is the scanning of an uploaded executable than an (automated) review process though? It's a pass of checks that might or might not find something. It's not some official stamp of approval, except to say "those checks passed ok".
- rowanG077 6y ago"Those checks passed ok" is an approval in itself. The notarization process has the outcome of either being approved or being denied. Approved means "officially agreed or accepted as satisfactory.".
- manicdee 6y agoWhen a Justice of the Peace notarises a piece of documentation, they are not vouching for authenticity they are only voicing for certain claims made: the document was presented on a certain date, and/or that this copy is an accurate facsimile of the provided original. Notarisation for macOS similarly only means, “the developer presented us with their application and their certificate of authenticity and we signed it with the certificate that allows macOS to run it without complaining.” There’s no attempt by Apple to claim that the application is safe or does what it says on the tin. Scanning for malware is simply to avoid embarrassing situations me an author/publisher finding they’ve been compromised by some well known malware. The outcome of notarisation is that the app has been notarised. It’s like claiming that the outcome of toasting a sandwich is approval or rejection, no the outcome of toasting a sandwich is you have a sandwich that is toasted, aka “toasted sandwich.” You might reject a sandwich which isn’t built properly (eg: has mismatched bread slices, is missing contents or smells of dynamite). But toasting the sandwich provided by the customer doesn’t mean you actually like it.
- gregoriol 6y agoThose news about Apple approving malware are so wrong: the notarization is not an approval, it's more like a registration. It would be news if it was on the App Store, which has a review.
- shakna 6y ago> The Apple notary service is an automated system that scans your software for malicious content, checks for code-signing issues, and returns the results to you quickly. [0] Apple seem to be saying that it is more than a registration process. Not passing a human review would be bigger, but it is a review of a kind. [0] https://developer.apple.com/documentation/xcode/notarizing_macos_software_before_distribution https://developer.apple.com/documentation/xcode/notarizing_m...
- dessant 6y agoIt's astonishing that the developer community is fine with requiring open source projects to pay $99/yr for notarization to run on macOS. Malware authors will happily pay the developer account fees, as seen here, while open source projects are seriously hindered. It should be possible to verify developers and distribute open source apps without a cost on macOS.
- dgellow 6y agoWhat makes you thing that open source developers are fine with that? What are their other choices? Apple doesn’t care.
- pmontra 6y agoThe choice is don't build for MacOS. In the long run Apple won't be happy with that and maybe they'll waive the fee.
- AnthonyMouse 6y agoHow would that get them to waive the fee? If your app is open source and they wanted it that bad they could just build it themselves, or develop their own replacement for it, and anybody else can pound sand. They have you over a barrel and they know it.
- pmontra 6y agoSo let's Apple port, build and distribute open source for MacOS. I have no problem with that. Yet I bet it would cost Apple more than the money they do from the license they sell to OS developers.
- AnthonyMouse 6y agoBut they're not going to do that for your project, only the ones they actually care about. In fact they already do this. Your macOS comes with bash (the old one because they don't like the new license) and a slew of other open source software. The whole thing is built on top of BSD. So they take what they want and then make you pay them for anything else.
- webwielder2 6y agoThey even gave Apple a head start by disguising it as Flash.
- cblconfederate 6y agoThe title is not justified. Nowhere in the text is it proven that it was approved by accident. It might have been an employee acting with malice aforethought
- _qulr 6y agoNotarization is an automated process. There's no human involved.
- cblconfederate 6y agoah then the title is completely false
- _qulr 6y agoIt's automated approval...
- cblconfederate 6y ago... which is neither approval nor accidental
- SyneRyder 6y agoMaybe "erroneously" is a better word than accidentally. That's the word Apple used when apologizing to Charlie Munroe for their automated systems revoking his Apple Developer ID and remotely disabling his published Mac apps: "We determined that your app Downie 4 was erroneously identified as malicious due to invalid logic in our malware detection system. This triggered the revocation of your certificate under Section 5.4 of the Developer Program License Agreement." https://blog.charliemonroe.net/a-day-without-business/ https://blog.charliemonroe.net/a-day-without-business/
- hundchenkatze 6y agoDid you read the article? It's an automated process. Unless you're referring to our robot overlords there was no malicious employee involved.
- deleted 6y ago[deleted]
- freeAgent 6y agoApple created a process whereby applications are run through automated checks for malware in order to be approved for installation on MacOS by the public. The title is accurate. The process isn’t perfect, but human review isn’t perfect either. One issue this brings up is the false sense of security that review and approval processes such as this create among users.
- diebeforei485 6y agoNotarization doesn't actually review the software. It's just a financial and technical barrier to reduce (not absolutely prevent) the spread of mutant versions of malware.