For years, hackers could hide malware alongside legitimate Apple code and sneak it past several popular third-party security products for Mac computers, according to new research. This is not a flaw in MacOS but an issue in how third-party security tools implemented Apple’s APIs.

A researcher from security firm Okta found that several security products for Mac—including Little Snitch, xFence, and Facebook’s OSquery—could be tricked into believing malware was Apple code, and let it past their defenses.

“I can take malicious code and make it look like it’s signed by Apple,” Josh Pitts, the security researcher at Okta who discovered these bugs, told Motherboard.

In a blog post published Tuesday, Pitts explained that the issue lies with how the third-party security tools implemented Apple’s code-signing APIs when dealing with Mac’s executable files known as Universal or Fat files. Code-signing is a mechanism that checks files to see if they are signed with digital certificate, which should mean that the code is authentic and comes from the firm that signed it. In the case of Apple’s MacOS, if a file is signed by Apple, the computer is programmed to trust it. But Pitts found that he could bundle malicious files with legitimate Apple-signed code and effectively make the malware look like it was signed by Apple. That way, some third-party tools did not detect the malware.

Read More...