Researcher Bypasses Apple’s Updated Malware Protection in ‘5 Minutes’ by Lorenzo Franceschi-Bicchierai.
From the post:
Apple’s Mac computers have long been considered safer than their Windows-powered counterparts—so much so that the common belief for a long time was that they couldn’t get viruses or malware. Even Apple adopted that cliche for marketing purposes.
The reality, however, is slightly different. Trojans have targeted Mac computers for years, and things don’t seem to be improving. In fact, cybercriminals created more malware targeting Macs in 2015 than in the past five years combined, according to one study. Since 2012, Apple has tried to protect users with Gatekeeper, a feature designed to block common threats such as fake antivirus products, infected torrent files, and fake Flash installers—all malicious software that Mac users might download while regularly browsing the internet.
But it looks like Gatekeeper’s walls aren’t as strong as they should be. Patrick Wardle, a security researcher who works for the security firm Synack, has been poking holes in Gatekeeper for months. In fact, Wardle is still finding ways to bypass Gatekeeper, even after Apple issued patches for two of the vulnerabilities he found last year.
As it is designed now, Gatekeeper checks apps downloaded from the internet to see if they are digitally signed by either Apple or a developer recognized by Apple. If so, Gatekeeper lets the app run on the machine. If not, Gatekeeper prevents the user from installing and executing the app.
…
That Apple and Wardle have been going back and forth for months, with Wardel sans the actual source code, is further evidence of the software quality you get with no liability for security flaws in software.
You would think that when a flaw was discovered in Gatekeeper, that a full review would be undertaken to find and fix all of the security issues in Gatekeeper.
No, Apple fixed only the security issue(s) pointed out to it, and no others.
Would that change if there were legal liability for security defects?
There’s only one way to find out.