Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.sys.mac.apps > #29703

Re: OS X security tools - trivial to bypass?

Show all headers | View raw

On 2015-04-27, Alan Browne <alan.browne@freelunchvideotron.ca> wrote:
> Someone else posted this link and other than a deflection to the past, 
> there's been no discussion of the here and now on this subject.  Anyone 
> care to weigh in?
>
> https://threatpost.com/bypassing-os-x-security-tools-is-trivial-researcher-says/112410
>
> QUOTE
> “Gatekeeper doesn’t verify an extra content in the apps. So if I can 
> find an Apple-approved app and get it to load external content, when the 
> user runs it, it will bypass Gatekeeper,”
> ENDQUOTE
>
> QUOTE
> Getting past XProtect turns out to be just as simple as bypassing 
> Gatekeeper. Wardle found that by simply recompiling a known piece of OS 
> X malware, which changes the hash, he could get the malware past 
> XProtect and execute it on the machine. Even simpler, he could just 
> change the name of the malware, which also lets it sneak in under the fence.
> ENDQUOTE

The first comment on the article says it all:

"Patrick Wardle is talking out if his ass. He’s basically saying if a
program runs arbitrary code, then arbitrary code might run. Wow so
insightful."

My take:

*yawn*

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

Back to comp.sys.mac.apps | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

OS X security tools - trivial to bypass? Alan Browne <alan.browne@freelunchvideotron.ca> - 2015-04-27 10:29 -0400
  Re: OS X security tools - trivial to bypass? Alan Browne <alan.browne@freelunchvideotron.ca> - 2015-04-27 10:36 -0400
  Re: OS X security tools - trivial to bypass? Jolly Roger <jollyroger@pobox.com> - 2015-04-27 15:45 +0000
    Re: OS X security tools - trivial to bypass? Alan Browne <alan.browne@freelunchvideotron.ca> - 2015-04-27 12:03 -0400

csiph-web