Mac Gatekeeper Bypassed by App Swap

A significant security vulnerability has been identified in macOS's Gatekeeper feature, allowing attackers to bypass its protections. Researchers Talal Haj Barky and Tommy Mysk have shown that if a legitimate application has been run at least once on a Mac, it can be replaced with malware. Gatekeeper, designed to prevent the execution of untrusted software, reportedly fails to re-verify the swapped application.

This exploit necessitates prior user-level code execution, meaning an attacker must first gain a foothold on the system. Methods for achieving this include a malicious app, a compromised package manager, or tricking an AI agent. Once user-level code execution is achieved, the attacker can archive a legitimate app, replace it with a malicious version, and Gatekeeper will not detect the change.

Upon reporting this vulnerability to Apple, the company apparently closed the issue without plans for a fix. Apple's stance is that this method of replacing an app bundle is considered a 'locally built' scenario, not a modification of the signed executable. Consequently, Apple argues that such situations fall outside Gatekeeper's operational scope, leaving the security against these types of attacks reliant on user awareness and social engineering defenses.