Slashdot Mirror
Apple's Gatekeeper Still Broken (csoonline.com)
itwbennett writes: This weekend, Apple security expert Patrick Wardle will detail a vulnerability in Apple's Gatekeeper that makes it possible to bypass the anti-malware defense. This is the same vulnerability that was disclosed last April, which Apple said it patched later. Wardle was able to easily bypass Apple's fixes. He says "all Apple did was blacklist the signed apps he was abusing, but didn't fix the underlying issue, which is that, essentially, Gatekeeper functions as a guard that doesn't check" software already on the whitelist.
People will still flock to Apple and buy the shit out of it. And Apple knows it.
Been a while, but wasn't Slammer actually a SQL Server worm, and I love you was an email-based Trojan?
You're absolutely correct, however, in pointing out that in the age-old contest between warhead and armour, warhead wins.
Vintage computer games and RPG books available. Email me if you're interested.
Apple is new to reacting effectively to security. Microsoft gets beat up about security, but they have learned to attempt to react better. May not be perfect.
I know so many Apple people that think Apple immune security issues. I seriously wonder if we will see a day when Apple is is hit with the same type of security questions that have plagued Microsoft over the years.
Windows spent almost two decades with admin privileges by default 24/7, no mandatory-access control, installations that could occur silently and without user input, core system updates through the web browser, whilst also being the only real desktop PC operating system (i.e. it was the most lucrative target for malware authors). It's actually sort of miraculous that the security ecosystem wasn't in even worse shape than it was.
By contrast, OS X's origins in unix give it a fairly safe grounding. The keyring and SIP in El Capitan also seem to be quite robust. And Apple users are more trusting of automatic security updates compared to Windows users (Microsoft poisoned that well when they started pushing shitty drivers and malware through their updates).
In any mode, you can run an unsigned or non-Apple-signed installer or app by control-clicking on it and choosing "Open".
Check out my sci-fi/humor trilogy at PatriotsBooks.
Its working exactly as its supposed to. Its not meant to stop everything, its just a whitelisting system with some authentication built it.
Blacklisting the offending apps is exactly how this type of system works.
Anything signed by a valid cert which has been signed by Apple's cert is trusted by default. Thats what having an Apple signature on top of the publisher signature means. This also means the applications are 'tamper proof' in theory, because changing the application invalidates the sig and the code no longer is whitelisted, so no virus will work.
The system then keeps a CRL, Certificate Revocation List. This list is ... blacklisted fingerprints. That is, certs or specific apps that were not known to be compromised or malicious when Apple originally vetted them, but something became known to be compromised after that process. The CRL list means Apple can effectively change its mind about apps that it previously approved.
This is all it is intended to do, and that alone mitigates a metric fuckton of exploit cases.
Doesn't prevent apps that don't get caught in review. But you won't get more than one or two malicious apps past them before you're completely cut off from getting certs ever again. Vendors outside the AppStore will have their certs revoked when exposed in the wild.
At no point was it intended to prevent every single exploit vector ever. You're pretty ignorant of how this stuff works if you think they ever said it was the cure all to security issues.
All it does is adds a layer of control to who can run arbitrary code on your system, and by default, allows Apple to give people permission to do so. You can also use your own certs and remove the AppStore cert, effectively making it so only apps signed with your cert will run on the machine ... or in the case of some companies, the company's cert is the only thing that runs on the machine.
itwbennet == bennet haselton / dumb
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
I got a call at work the other day that I thought I recognized the number I was in a good mood and thought about answering "IT, have you tried turn it off and on again?" but settled for "Technical support, I'll be your password reset technician today."
Turns out it was a scammer claiming to be from MS... so after he said his intro I said "Yes, you've reach technical support. Do you need me to reset your password?" then he stammered and and tried to explain about how my computer was having issues and I said "Ok, I have reset your password but it will take about 15 minutes for the changes to go through. If you have any other issues go ahead and call back."
Same point in the lifecycle? Apple has been around, as a company in the OS business, as long/longer than MS. And things like rootless OSX are expectations, because people learn from other people;s experience.
I get that rewriting means there are needed patches. But when Apple wrote OSX, security was a real thing. And eliminating a lot of legacy code should prevent the source of a lot of issues.
Your ad here. Ask me how!
The reason I'm very anti-Apple is particularly our younger professors decide that they need to have apple computers, phones, and tablets to be hip. So they get them, against recommendations. Now never mind that these cost a lot more money than they'd spend on equivalent hardware but then the support issues start. Turns out that Mac don't just magically work, and they have problems with things (accessing the central storage is something Macs have been particularly problematic with) and they whine to us despite promising that they understand and will support things themselves.
Apple wants to pretend to be good for the enterprise, but their enterprise features are garbage. So people get them, want them to integrate, they don't, and then they cry about it.
Gatekeeper isn't for security. Gatekeeper is intended to make running non-Apple approved code just annoying enough to force most users to use the App Store rather than use non-Apple blessed code. As they've demonstrated with the latest OS X where not even root can write to /usr or /bin
Or, rather, where you have to go through an annoying procedure, involving two reboots, to write to /usr or /bin.