{"id":88354,"date":"2019-06-24T09:34:19","date_gmt":"2019-06-24T16:34:19","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=88354"},"modified":"2019-07-01T00:07:53","modified_gmt":"2019-07-01T07:07:53","slug":"osx-linker-new-mac-malware-attempts-zero-day-gatekeeper-bypass","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/osx-linker-new-mac-malware-attempts-zero-day-gatekeeper-bypass\/","title":{"rendered":"OSX\/Linker: New Mac malware attempts zero-day Gatekeeper bypass"},"content":{"rendered":"

\"\"Last week, Intego researchers discovered new Mac malware, OSX\/Linker<\/strong>, that attempts to leverage a recently disclosed zero-day flaw in macOS’ Gatekeeper protection.<\/p>\n

Let’s examine what we know about this latest Mac malware campaign.<\/p>\n

What is the back story?<\/h3>\n

\"\"Before digging into the OSX\/Linker<\/strong> malware, it would be helpful, for context, to discuss the “MacOS X GateKeeper Bypass” vulnerability that was publicly disclosed<\/a> by Filippo Cavallarin on May 24.\u00a0Gatekeeper<\/a> is a technology included in macOS that is supposed to check apps downloaded from the Internet\u00a0for either a revoked developer signature, or for certain specific malware that Apple chooses to detect, before allowing an app to run.<\/p>\n

The more technical explanation:<\/strong> Cavallarin noted that macOS treats apps loaded from a network share differently than apps downloaded from the Internet. By creating a symbolic link<\/a> (or “symlink”\u2014similar to an alias) to an app hosted on an attacker-controlled\u00a0Network File System<\/a> (NFS) server, and then creating a .zip archive containing that symlink and getting a victim to download it, the app would not be checked by Apple’s rudimentary XProtect<\/a> bad-download blocker.<\/p>\n

The simpler explanation:<\/strong> This trick makes it easier for malware to infect a Mac\u2014even if Apple has a built-in signature that’s supposed to protect your Mac from that malware.<\/p>\n