Apple's walled garden OS has its points

Apple has been historically very good at keeping malware out of their app store, and they're constantly improving their security protocols on that front. In fact, since February of this year, all Mac software distributed outside of its Mac App Store must be notarized by Apple. The developers must demonstrate that their products are capable of running on macOS Catalina and above.

Any software developed for macOS goes through a multi-stage approval process, with the first step being automated. It is designed to scan software for code-signing issues and malicious components. Assuming the submitted code passes through this security checkpoint, the apps are put on the macOS Gatekeeper list. The list signifies that they've been scanned and it has been determined that they don't pose a security risk.

While this process was designed to give users greater peace of mind, it's not bulletproof, as Mac user Peter Dantini recently discovered. He found notarized Shlayer adware installers that were being distributed through a variety of fake websites. These installers could run on any machine using macOS Catalina without being auto-blocked when they tried to launch.

Apple Seal of Approval is breached

The worst part about this is the fact that since these installers bear Apple's "seal of approval," users are bound to trust them without question, which means that the malware developers' payloads can spread like wildfire through the Apple ecosystem.

Legendary security researcher Patrick Wardle confirmed all of the above and reported it to Apple direct. Apple tends to take reports from Mr. Wardle seriously, and the company responded immediately by revoking those certificates. That means that any installation attempts will be auto-blocked by Gatekeeper.

Unfortunately, it appears that the Shlayer campaign is still ongoing, the hackers having simply shifted gears and are now serving new payloads, notarized on the same day that Apple revoked the initial sample's certificates.

As Patrick Wardle notes

"Both the old and 'new' payload(s) appears to be nearly identical, containing 'OSX.Shlayer' packaged with the Bundlore adware. However the attackers' ability to agilely continue their attack (with other notarized payloads) is noteworthy.

Clearly, in the never-ending cat & mouse game between the attackers and Apple, the attackers are currently (still) winning."

Our perspective

Indeed. Best of luck to Apple, and if you're a mac user, stay safe out there.

~ As Hill Street Blues' Sgt. Esterhaus always advised: "Hey, let's be careful out there! " ~


By Denis Wilson and Melissa Stockwell

Thanks for reading this short post. For more tips on thriving with small business technology, check out the other blog posts at DWPIA Blogs. You can also find me on LinkedIn, Facebook, and Twitter.

Cybersecurity Expert, Small Business Technology Consultant, Managed Services Provider, Managed IT SupportI'm Denis Wilson, President and Principal Consultant for DWP Information Architects. We build people/process/technology solutions to create better business outcomes for smaller enterprises in Los Angeles. We have created cost-effective office productivity and out-sourced service solutions for over 20 years, focusing principally on manufacturing, professional services, and healthcare.  Our hallmarks are cloud and on-premises network reliability, cost-effective cybersecurity, and livable small business regulatory compliance.

I am also a published author and speaker, working extensively with business and professional associations to provide small business technology education programs. Contact me if you would like me to speak at your association