Filippo Cavallarin security researcher recently disclosed security vulnerabilities of a macOS that could allow hackers to bypass the Gatekeeper security mechanisms to execute arbitrary programs.
Gatekeeper is Apple since 2012, security mechanisms deployed in macOS X, which can detect and block both malicious programs, as well as users to download malicious files from the network, ensure macOS X can only be executed from the App Store Apple Developer program or to obtain credentials.
However, Cavallarin pointed out that in the current implementation, Gatekeeper external drives and network shares as a "safe position." This means that it allows any application to run these positions included without checking the code again, if this design combined with two legitimate function of macOS X, Gatekeeper can be completely bypassed.
The first is a legitimate function automount (aka autofs), which allows the user (in this case, any path to "/ net /" beginning) to mount network access only by "special" path.
The second is a legitimate function of a zip archive may contain symbolic links to any location (including automount enpoints), and is responsible for software unzip the zip file does not perform any checks on them before you create symbolic links on macOS.
Thus, the hacker can first create a zip file containing a symbolic link automount endpoint hackers control point (from Documents -> /net/evil.com/Documents) and sends it to the victim. Victims download malicious files, extract and follow symbolic links. Now, the victim is located under the attacker's control, but the state by Gatekeeper trust, so any attacker can control any file, and the victims do not receive a warning.
Cavallarin said he was informed Apple this year, February 22, which should be published macOS 10.14.5 solving this problem in May 15. But Apple did not successfully patched the vulnerability, nor respond to e-mail again, so he chose to open to the public details of the vulnerability.
Finally, Cavallarin given a possible solution - disable auto mount:
- As root edit / etc / auto_master
- Comments to '/ net' at the beginning of the line
- Restart