Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS gatekeeper and file quarantine bypass

objective-see.com

Post reply on HN
Print view View original

81–90 of 125 posts

Re: macOS gatekeeper and file quarantine bypass

#81

Post by azinman2 »

joshspankit wrote: post #47
Wowfunhappy wrote: post #9

Earlier quoted context omitted.

Then turn it off. Open the Terminal and run: sudo spctl --master-disable That's it, it will never bother you again, unless you turn it back on or reinstall the OS from scratch. If macOS is still too limiting, you can also turn off System Integrity Protection, at which point you can do just about whatever the heck you want. I personally kept both Gatekeeper and SIP turned off, back when I used modern macOS. But if the…

Does turning those off still leave the logs redacted? Or do you also have to install the profile after you tell it to get out of your way?

That has nothing to do with log redaction. That's to prevent private data escaping apps and either being sent to Apple or readable by others. You want that on.

Re: macOS gatekeeper and file quarantine bypass

#82

Post by LeoPanthera »

jdlshore wrote: post #43

Fascinating article. Short version: there was a bug in the part of Apple’s Gatekeeper code that checked whether a file was an application bundle. Bundles that only contained a script, and not a plist file, were considered “not a bundle,” and this bypasses the Gatekeeper checks. The issue is fixed in the latest version of Big Sur. Be sure to upgrade. It’s being exploited in the wild.

Is this how early versions of the Zoom installer bypassed gatekeeper for a zero-click install?

Re: macOS gatekeeper and file quarantine bypass

#83

Post by FridayoLeary »

judge2020 wrote: post #29
setr wrote: post #24

Earlier quoted context omitted.

Windows gives you a big warning when you change the extension, which seems to me both sufficient and better than hiding the extension altogether (which, like URL hiding, is a fairly dangerous and largely unnecessary convenience)

I've learned to never underestimate users' ability to shoot themselves in the foot. People will click through any popup dialogue which might suggest that their decision to perform an action was wrong.

because most of them are clearly fearmongering by ms, apple et al, scaring you into staying subscribed to their particular product. If they abuse their own warning systems, why should we respect them?

Re: macOS gatekeeper and file quarantine bypass

#84

Post by sildur »

benatkin wrote: post #58
jdlshore wrote: post #43

Fascinating article. Short version: there was a bug in the part of Apple’s Gatekeeper code that checked whether a file was an application bundle. Bundles that only contained a script, and not a plist file, were considered “not a bundle,” and this bypasses the Gatekeeper checks. The issue is fixed in the latest version of Big Sur. Be sure to upgrade. It’s being exploited in the wild.

> Be sure to upgrade. This is a technical crowd, so some of us don't need to rush to download things like this. I'll upgrade when it's convenient, thank you very much.

Funny that when you started with "this is a technical crowd" I thought you will continue with "we don't need to be reminded to upgrade".

Re: macOS gatekeeper and file quarantine bypass

#85

Post by Wowfunhappy »

unicornporn wrote: post #63
Wowfunhappy wrote: post #9

Earlier quoted context omitted.

Then turn it off. Open the Terminal and run: sudo spctl --master-disable That's it, it will never bother you again, unless you turn it back on or reinstall the OS from scratch. If macOS is still too limiting, you can also turn off System Integrity Protection, at which point you can do just about whatever the heck you want. I personally kept both Gatekeeper and SIP turned off, back when I used modern macOS. But if the…

What would I need to get it down to a Mojave level of inconvenience?

That I can't answer. The most recent version of macOS I've used for any length of time was High Sierra, because even Mojave broke something essential for me—Apple Events need to be authorized once for every combination of (1) the app being controlled and (2) the app sending the event. Combined with the fact that my authorizations were often reset when I edited a script, this made most of my Applescripts effectively useless.

But it's a very different problem from Gatekeeper. And from iOS, where the user legitimately has no control. If SIP is turned off, you could write an app that strips out every macOS behavior you dislike, because without SIP apps can patch whatever they want.

Re: macOS gatekeeper and file quarantine bypass

#86

Post by ghughes »

kossTKR wrote: post #7

Does anyone know how trustworthy this objective-see project is? I remember once installing several of his apps, but then coming to the conclusion that i don't know enough - even though he consistently seems to find and fix flaws in OSX. Why isn't Apple hiring this man? EDIT: Why are people downvoting this question? If i'm implying something then i'm unaware of it.

The tools are legit, and the bugs are real, but he has a distasteful habit of feeding sensationalist quotes to outlets like Forbes and Vice.

This time, he told Forbes that "the hacks effectively take Mac security back a decade" [1], and Vice quotes him as saying "this is likely the worst or potentially the most impactful bug to everyday macOS users in recent memory". [2]

Forbes ran the story with the headline "The ‘Worst Hack In Years’ Hits Apple Computers", and that's bullshit.

1. https://www.forbes.com/sites/thomasbrewster/2021/04/26/updat...

2. https://www.vice.com/en/article/wx5855/massive-mac-apple-sec...

Re: macOS gatekeeper and file quarantine bypass

#87

Post by crazygringo »

Isthatablackgsd wrote: post #5
kstrauser wrote: post #4

Earlier quoted context omitted.

What frustrates you about it? I rarely bump into Gatekeeper and I'm doing the normal dev things.

I'm assuming you don't use the package manager like Homebrew or MacPorts? this is where the gatekeeper will annoy the hell out of me. Apps installed via Homebrew often will encounter Gatekeeper alerts. Half of them will give the option to open it and the other half, the gatekeeper --demands-- gently ask me to put it in the Trash without the option to open it.

That's... unusual.

I use Homebrew constantly and have never seen such a thing in my life, in any version of macOS/OSX over the past several years. Not in building from source, not in casks.

Like another commenter the only security change I have is "Allow apps downloaded from" set to "App store and identified developers" -- which I'd assume virtually every Mac user on HN has also set.

Perhaps you have some kind of unusual configuration? Or there's some very specific subcategory of Homebrew packages that encounter this problem?

Re: macOS gatekeeper and file quarantine bypass

#88

Post by Xeago »

LeoPanthera wrote: post #82
jdlshore wrote: post #43

Fascinating article. Short version: there was a bug in the part of Apple’s Gatekeeper code that checked whether a file was an application bundle. Bundles that only contained a script, and not a plist file, were considered “not a bundle,” and this bypasses the Gatekeeper checks. The issue is fixed in the latest version of Big Sur. Be sure to upgrade. It’s being exploited in the wild.

Is this how early versions of the Zoom installer bypassed gatekeeper for a zero-click install?

That worked by using the preinstall check that Installer.app invokes to do the installation. It would finish by force quitting Installer.

Re: macOS gatekeeper and file quarantine bypass

#89

Post by Wowfunhappy »

setr wrote: post #54
Isthatablackgsd wrote: post #48

Earlier quoted context omitted.

Apologies for misreading you, I'm just frustrated and accepted the fact that it is by design. I been reading other comments and as someone (xrisk) pointed out that it is Homebrew Casks which it made sense since all of the gatekeeper alerts is coming from 'Cask-ed' apps. I could disable Gatekeeper but I rather not because MacOS is not my daily driver. I rather to keep Gatekeeper active to protect itself from moronic m…

Probably the simplest thing then would be to alias brew install to something like spctl —master-disable; brew install $1; spctl —master-enable

`spctl --master-disable` requires root permissions (sudo).

You could edit sudoers so the command doesn't require a password. But really, at that point I'd just leave Gatekeeper off.

Post reply on HN