In February 2020, Apple implemented a new system to validate new software on macOS. A fully automated process that analyzes the source code of software to make sure it is secure. Unfortunately, this automation of the process proved its weaknesses a few weeks ago and it was not a first.

Researcher Matt Muir recently discovered that Apple had notarized – or validated – a malicious application on macOS. The latter pretended to be an installer of Adobe Flash Player, but was actually hiding malware. To confuse the issue, the authors of the corrupt installer hid the malware code in a JPEG image, thus fooling Apple’s security system. This is a fairly widespread technique, known as steganography.

Minimal damage

Once installed, the malware could deploy and modify the default web browser search engine on Macs. The damage caused by the OSX / MacOffers malware was not that great, but if it was able to find its way into Apple’s operating system undetected, others may repeat the feat and next time the consequences could be more serious. In this case, Apple learned of its error and removed the malware certificate.

We can still hope that Apple will strengthen its automated process for validating software on macOS to prevent other malware from reaching the Mac.