Silent Replacement of Trusted macOS App Executables Without Admin Privileges
I discovered a macOS vulnerability allowing attackers to silently replace trusted app executables downloaded from the web. By archiving and restoring an app bundle, malicious code can run under the guise of legitimate software like Signal or Slack. This method bypasses security warnings and tricks users into granting access to sensitive data, yet Apple has decided not to issue a fix for this behavior.
We found a macOS security issue that Apple looked into but decided not to fix.
- jwatzman
Not sure I understand the risk here, and seem to agree with Apple this is a non-issue. You already have code execution in order to exploit this. You don’t get the cryptographic identity of the victim app so you can’t steal keychain secrets. How is this any different than just bundling your own second-stage malware with a victim bundle ID, then using your existing code execution to remove the quarantine flag and then run the second-stage malware? Or just doing the evil things with your existing code execution?
- yogorenapan
Ah I remember a very similar bug. I remember back in the day, I'd use a fork of TheBackdoorFactory so that the replaced app still functions as usual and in the background request permissions & stuff to then be able to do stuff like key logging. Apple also responded with won't fix, but I think at some point silently patched it.
- hyperhello
Instead of replacing the executable, couldn’t it be wrapped and augmented, so it’s just running payload in the background with the original permissions and keychain access? It does seem pretty bad.