At the end of last month, we informed you about a security flaw in the tool GateKeeper in macOS. This serves, among other things, to prevent the installation of software whose code has not been signed by the company AppleThe flaw was discovered by security expert Filippo, who said that according to his findings, it allows bypassing security settings. GateKeeperu. Apple however, he had yet to correct her and she stopped responding to Cavallarino's emails. But that was a mistake.
Gallery
It didn't take long for the security firm Intego to come up with a report on a case of exploiting the mentioned vulnerability. Intego's malware research team discovered a case of malware distribution in the preparation phase. The distribution was supposed to happen using a disk image. It had either ISO 9660 or dmg format. Dmg is a common file format Apple Disk Image, often used with software intended for the Mac. Interestingly, Mac malware often uses an iso disc image rather, apparently in an attempt to bypass anti-malware software measures.
You might be interested in
Intego examined a total of four malware samples captured by VirusTotal in early June. The individual findings occurred within a few hours and all led to one specific application on the NFS server. According to Intego, it is most likely OSX/Surfbuyer adware. At first glance, disk images "look" like Adobe Flash Player installation files. This is a fairly common tactic among malware creators to get malicious software into Macs.
You might be interested in
The samples mentioned only created a temporary text file. Since *.app are dynamically linked in disk images, their server location can easily change at any time without having to change the disk image itself. It is therefore possible that the authors have already programmed malware that may not be caught by antimalware in the future. Security experts therefore recommend installing applications only from official App Store.
