Microsoft Details Gatekeeper Bypass Vulnerability in Apple macOS Systems

Dec 20, 2022Ravie LakshmananEndpoint Security / Vulnerability

Microsoft has disclosed details of a now-patched security flaw
in Apple macOS that could be exploited by an attacker to get around
security protections imposed to prevent the execution of malicious
applications.

The shortcoming, dubbed Achilles (CVE-2022-42821^[1], CVSS score: 5.5), was
addressed by the iPhone maker in macOS Ventura
13^[2], Monterey
12.6.2^[3], and Big Sur
11.7.2^[4], describing it as a
logic issue that could be weaponized by an app to circumvent
Gatekeeper checks.

“Gatekeeper bypasses such as this could be leveraged as a vector
for initial access by malware and other threats and could help
increase the success rate of malicious campaigns and attacks on
macOS,” Jonathan Bar Or of the Microsoft 365 Defender Research Team
said^[5].

Gatekeeper is a security mechanism^[6]
designed to ensure that only trusted apps run on the operating
system. This is enforced^[7]
by means of an extended attribute called “com.apple.quarantine”
that’s assigned to files downloaded from the internet. It is
analogous to the Mark of the Web (MotW^[8]) flag in Windows.

Thus when an unsuspecting user downloads a potentially harmful
app that impersonates a piece of legitimate software, the
Gatekeeper feature prevents the apps from being run as it’s not
validly signed and notarized by Apple.

Even in instances where an app is approved by Apple, users are
displayed a prompt when it’s launched for the first time to seek
their explicit consent.

Given the crucial role played by Gatekeeper in macOS, it’s hard
not to imagine the consequences of sidestepping the security barrier^[9], which could effectively
permit threat actors to deploy malware on the machines.

The Achilles vulnerability identified by Microsoft exploits a
permission model called Access Control Lists (ACLs^[10]) to add extremely
restrictive permissions to a downloaded file (i.e., “everyone deny
write,writeattr,writeextattr,writesecurity,chown”), thereby
blocking Safari from setting the quarantine extended attribute.

In a hypothetical attack scenario, an adversary could embrace
the technique to craft a rogue app and host it on a server, which
could then be delivered to a possible target via social
engineering, malicious ads, or a watering hole.

The method also circumvents Apple’s newly introduced Lockdown
Mode^[11] in macOS Ventura – an
opt-in restrictive setting to counter zero-click exploits^[12] – necessitating that
users apply the latest updates to mitigate threats.

“Fake apps remain one of the top entry vectors on macOS,
indicating Gatekeeper bypass techniques are an attractive and even
a necessary capability for adversaries to leverage in attacks,” Bar
Or said.