10 ms·
Gatekeeper really can't do much against a spear phishing attack. If someone's running a scam specifically to target a single person or a small group of people,
by pflats 13y ago
Gatekeeper really can't do much against a spear phishing attack. If someone's running a scam specifically to target a single person or a small group of people, and has spent the time and energy figuring out how to get them to open a malicious file, having an Apple ID is a $100 speed bump.
Gatekeeper is meant to prevent a wide-ranging attack. If you've got someone custom crafting an attack vector for you specifically, you've got some serious problems. I don't think Gatekeeper adds any more false security than an antivirus app would, and I don't know of any software that'd prevent an attack like this.
At best, it adds a small amount of information for authorities to try to track the attack. I doubt it'll be fruitful, but it's better than nothing.
- cooldeal 13y ago>I don't think Gatekeeper adds any more false security than an antivirus app would, and I don't know of any software that'd prevent an attack like this. It helps if you're using a non-rooted Chromebook, iDevice or WindowsRT device. Then the attackers have to look for exploits in the mail client/OS instead of just sending a link to a .dmg or .exe.
- awakeasleep 13y agoI'd go as far as to say, if someone is spending the money to hire a competent foe to attack a specific person who isn't a paranoid security expert, there isn't much chance they'll escape uncompromised.
- duaneb 13y agoExactly. We're all lazy because we only expect general attacks, we expect that we won't be the first person attacked.
- pi18n 13y agoWhat I don't like about Gatekeeper is that there is no way to revoke Apple's cert and replace it with another. Not that that would protect the activist in question, but it would certainly make a company machine secure against this kind of attack.
- eridius 13y agoIf I understand you correctly, it would also prevent you from launching any codesigned application, including the OS-provided ones, since they would all be considered to have an invalid code signature. So yeah, I guess in a certain light, a machine that can't launch apps is definitely secure.
- pi18n 13y agoGood point. I think you half misunderstood; their certificate should be replaceable so that you disallow third-party software from developers in their developer program and allow it from your company only or vendor A only. Obviously one would need to implicitly allow certain OS processes and Finder for the system to work, but my point is basically that we should not be beholden to Apple beyond that, the CA should be something we can choose.