{"uuid": "9df36b98-605b-4e75-ac84-a44aa8d1a5fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-26706", "type": "seen", "source": "https://t.me/hacking_Attack/81265", "content": "Black Hat Ethical Hacking\nMicrosoft finds macOS bug that lets malware bypass security checks\n\nMicrosoft finds macOS bug that lets malware bypass security checksPost Views: 17 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Apple has fixed a vulnerability attackers could leverage to deploy malware on vulnerable macOS devices via untrusted applications capable of bypassing Gatekeeper application execution restrictions.Found and reported by Microsoft principal security researcher Jonathan Bar Or, the security flaw (dubbed Achilles) is now tracked as CVE-2022-42821.\n\nApple addressed the bug in macOS 13\u00a0(Ventura), macOS 12.6.2\u00a0(Monterey), and macOS 1.7.2\u00a0(Big Sur) one week ago, on December 13.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Gatekeeper bypass via restrictive ACLsGatekeeper\u00a0is a macOS security feature that automatically checks all apps downloaded from the Internet if they are notarized and developer-signed (approved by Apple), asking the user to confirm before launching or issuing an alert that the app cannot be trusted.\n\nThis is achieved by checking an extended attribute named com.apple.quarantine which is assigned by web browsers to all downloaded files, similar to Mark of the Web in Windows.\n\nThe Achilles flaw allows specially-crafted payloads to abuse a logic issue to set restrictive Access Control List (ACL) permissions that block web browsers and Internet downloaders from setting the com.apple.quarantine attribute for downloaded the payload archived as ZIP files.\n\nAs a result, the malicious app contained within the archived malicious payload launches on the target\u2019s system instead of getting blocked by Gatekeeper, allowing attackers to download and deploy malware.\n\nMicrosoft said on Monday that \u201cApple\u2019s Lockdown Mode, introduced in macOS Ventura as an optional protection feature for high-risk users that might be personally targeted by a sophisticated cyberattack, is aimed to stop zero-click remote code execution exploits, and therefore does not defend against Achilles.\u201d\n\n\u201cEnd-users should apply the fix regardless of their Lockdown Mode status,\u201d the Microsoft Security Threat Intelligence team added. https://www.microsoft.com/en-us/videoplayer/embed/RE5dQo5\nTrending: A primer on OS Command Injection Attacks\nTrending: Digital Forensics Tool: Email Analyzer \u200bMore macOS security bypasses and malwareThis is just one of multiple Gatekeeper bypasses found in the last several years, with many of them abused in the wild by attackers to circumvent macOS security mechanisms like Gatekeeper, File Quarantine, and System Integrity Protection (SIP) on fully patched Macs.\n\nFor instance, Bar Or reported a security flaw dubbed Shrootless\u00a0in 2021 that can let threat actors bypass System Integrity Protection (SIP) to perform arbitrary operations on the compromised Mac, elevate privileges to root, and even install rootkits on vulnerable devices.\n\nThe researcher also discovered powerdir, a bug that allows attackers to bypass Transparency, Consent, and Control (TCC) technology to access users\u2019 protected data.\n\nHe also released exploit code for a macOS vulnerability (CVE-2022-26706) that could help attackers bypass sandbox restrictions\u00a0to run code on the system.\n\nLast but not least, Apple fixed a zero-day macOS vulnerability in April 2021 that enabled threat actors behind the notorious Shlayer malware\u00a0to circumvent Apple\u2019s File Quarantine, Gatekeeper, and Notarization security checks and download more malware on infected Macs.\n\nShlayer\u2019s creators had also managed to get their payloads through Apple\u2019s automated notarizing process[...]", "creation_timestamp": "2026-09-01T20:01:12.704159Z"}