Researcher claims that attackers can easily bypass current OSX security tools

Most Mac users feel as though they are impenetrable to viruses and malicious software, but according to one researcher that is not the case. While Apple has its fair share if security measures in place, recent data has surfaced suggesting those tools are “trivial” for any attacker to bypass. For sometime, most people believed that owning a Mac was a safe choice, and that only Windows users could get hacked. However, researcher Patrick Wardle doesn’t seem to think so.

During a talk at the RSA Conference recently, Wardle explained the security measures on OSX are actually full of holes, if a competent hacker chose to exploit them. First up, he said that GateKeeper, Apple’s app verifier, doesn’t check extra content in apps, but rather only the app bundle itself. Meaning that attackers could load a verified app with dangerous extra content and it could, according to Wardle, slide right through Apple’s security.

The researcher went on to say that Apple’s sandbox technology on OSX is quite strong in terms of security, but there were a number of bugs that can be used to bypass it. On top of what Wardle called a“trivial to bypass” anti-malware system, he also found issues with code signing:

The code signing just checks for a signature and if it’s not there, it doesn’t do anything and lets the app run. I can unsign a signed app and the loader has no way to stop it from running.

It’s hard to imagine, with that many security flaws, that we haven’t seen mass hysteria break out among the Mac crowd. But it is clear that Apple should be looking into these holes, as it is likely only a matter of time before serious issues start to arise.

via Researcher claims that attackers can easily bypass current OSX security tools – TechSpot.