Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.sys.mac.apps > #29701 > unrolled thread

OS X security tools - trivial to bypass?

Back to article view | Back to comp.sys.mac.apps

Contents

  OS X security tools - trivial to bypass? Alan Browne <alan.browne@freelunchvideotron.ca> - 2015-04-27 10:29 -0400
    Re: OS X security tools - trivial to bypass? Alan Browne <alan.browne@freelunchvideotron.ca> - 2015-04-27 10:36 -0400
    Re: OS X security tools - trivial to bypass? Jolly Roger <jollyroger@pobox.com> - 2015-04-27 15:45 +0000
      Re: OS X security tools - trivial to bypass? Alan Browne <alan.browne@freelunchvideotron.ca> - 2015-04-27 12:03 -0400

#29701 — OS X security tools - trivial to bypass?

Someone else posted this link and other than a deflection to the past, 
there's been no discussion of the here and now on this subject.  Anyone 
care to weigh in?

https://threatpost.com/bypassing-os-x-security-tools-is-trivial-researcher-says/112410

QUOTE
“Gatekeeper doesn’t verify an extra content in the apps. So if I can 
find an Apple-approved app and get it to load external content, when the 
user runs it, it will bypass Gatekeeper,”
ENDQUOTE

QUOTE
Getting past XProtect turns out to be just as simple as bypassing 
Gatekeeper. Wardle found that by simply recompiling a known piece of OS 
X malware, which changes the hash, he could get the malware past 
XProtect and execute it on the machine. Even simpler, he could just 
change the name of the malware, which also lets it sneak in under the fence.
ENDQUOTE

[toc] | [next] | [standalone]

#29702

Wrong group.  Re-posted in the system group.  Sorry 'bout that.

On 2015-04-27 10:29, Alan Browne wrote:
> Someone else posted this link and other than a deflection to the past,

[toc] | [prev] | [next] | [standalone]

#29703

On 2015-04-27, Alan Browne <alan.browne@freelunchvideotron.ca> wrote:
> Someone else posted this link and other than a deflection to the past, 
> there's been no discussion of the here and now on this subject.  Anyone 
> care to weigh in?
>
> https://threatpost.com/bypassing-os-x-security-tools-is-trivial-researcher-says/112410
>
> QUOTE
> “Gatekeeper doesn’t verify an extra content in the apps. So if I can 
> find an Apple-approved app and get it to load external content, when the 
> user runs it, it will bypass Gatekeeper,”
> ENDQUOTE
>
> QUOTE
> Getting past XProtect turns out to be just as simple as bypassing 
> Gatekeeper. Wardle found that by simply recompiling a known piece of OS 
> X malware, which changes the hash, he could get the malware past 
> XProtect and execute it on the machine. Even simpler, he could just 
> change the name of the malware, which also lets it sneak in under the fence.
> ENDQUOTE

The first comment on the article says it all:

"Patrick Wardle is talking out if his ass. He’s basically saying if a
program runs arbitrary code, then arbitrary code might run. Wow so
insightful."

My take:

*yawn*

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#29705

On 2015-04-27 11:45, Jolly Roger wrote:
> On 2015-04-27, Alan Browne <alan.browne@freelunchvideotron.ca> wrote:
>> Someone else posted this link and other than a deflection to the past,
>> there's been no discussion of the here and now on this subject.  Anyone
>> care to weigh in?
>>
>> https://threatpost.com/bypassing-os-x-security-tools-is-trivial-researcher-says/112410
>>
>> QUOTE
>> “Gatekeeper doesn’t verify an extra content in the apps. So if I can
>> find an Apple-approved app and get it to load external content, when the
>> user runs it, it will bypass Gatekeeper,”
>> ENDQUOTE
>>
>> QUOTE
>> Getting past XProtect turns out to be just as simple as bypassing
>> Gatekeeper. Wardle found that by simply recompiling a known piece of OS
>> X malware, which changes the hash, he could get the malware past
>> XProtect and execute it on the machine. Even simpler, he could just
>> change the name of the malware, which also lets it sneak in under the fence.
>> ENDQUOTE
>
> The first comment on the article says it all:
>
> "Patrick Wardle is talking out if his ass. He’s basically saying if a
> program runs arbitrary code, then arbitrary code might run. Wow so
> insightful."
>
> My take:
>
> *yawn*


That's too dismissive given the claims.  The issue isn't the running of 
arbitrary code but how that code can be loaded and executed because of 
defects in the security system.

Don't dismiss this too quickly.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.sys.mac.apps

csiph-web