Mac O/S Gatekeeper OSX/Linker Malware Unpatched

Forum Moderators: travelin cat

Message Too Old, No Replies

Mac O/S Gatekeeper OSX/Linker Malware Unpatched

engine

11:35 am on Jun 26, 2019 (gmt 0)

An unpatched Mac O/S Gatekeeper malware, named OSX/Linker, remains a threat, according to researchers.

The trick involved packing a symlink (symbolic link) inside an archive file and having the symlink link back to an attacker-controlled Network File System (NFS) server.

Cavallarin found that Gatekeeper wouldn't scan these types of files, and would allow users to execute the symlinks. If the symlinks were malicious, attackers could run harmful code on victims' macOS systems.

[zdnet.com...]

not2easy

2:52 pm on Jun 26, 2019 (gmt 0)

Since the Gatekeeper itself can be easily disabled I don't know that patching it is a priority. The Gatekeeper is where you would set your Mac to download from only the AppStore OR from the AppStore + approved (Apple certified) developers OR from anywhere at all.

IF you choose "from anywhere" the Gatekeeper is disabled so it wouldn't be likely to be active on a machine that downloads un-certified apps potentially carrying the malware link payload that interacts with Gatekeeper.

_{Or else I don't get it.}