Apple’s macOS operating system has such a strong reputation for security that many people mistakenly believe Macs simply aren’t affected by malware. Well, Microsoft has served up a reminder that that’s not true, as the company has identified a serious vulnerability that affects one of macOS’s most important lines of defense.
According to Bleeping Computer, the bug was first reported by Jonathan Bar Or, Microsoft’s principal security researcher, who named the flaw Achilles. It is now tracked as CVE-2022-42821.
In simple terms, Achilles works by bypassing macOS’s Gatekeeper feature. Whenever a user downloads a Mac app, plugin, or installer that is not from Apple’s App Store, Gatekeeper checks that it is from a verified developer, is notarized by Apple to be free of malware, and hasn’t been altered. If the app passes those checks, it can run on the user’s Mac. If it fails, Gatekeeper blocks it.
Achilles, however, found a way around this protection. As laid out in a recent Microsoft blog post, macOS assigns an extended attribute called com.apple.quarantine to apps downloaded using internet browsers. Among other things, this attribute tells macOS that Gatekeeper should check the file before it can be installed.
Achilles blocks the assignment of this attribute. That means a malicious file will be able to run on macOS without ever triggering Gatekeeper, thereby side-stepping Apple’s built-in security protections.
Interestingly, Microsoft says macOS’s Lockdown Mode is no use in fighting Achilles because it is designed to solve a different problem. Lockdown Mode is a special high-security mode in macOS that protects individuals who are vulnerable to highly sophisticated cyberattacks — think journalists in repressive states, for example. Regardless of your Lockdown Mode status, you should update macOS to protect against Achilles.
The security flaw was originally discovered by Microsoft in July 2022, and was fixed by Apple in macOS 13 (Ventura), macOS 12.6.2 (Monterey), and macOS 11.7.2 (Big Sur). It highlights the importance of keeping macOS up to date to ensure you have the latest security patches and fixes.
It’s not the first time Microsoft has spotted a macOS vulnerability and helped Apple fix it. In February 2022, for example, Microsoft issued a warning about a macOS trojan called UpdateAgent. Interestingly, this malware could also get around Gatekeeper. It shows that while Gatekeeper is an excellent piece of defensive software, it’s not bulletproof.
