Common malware slipped past the macOS notarization process twice

Apple immediately revoked the notarization, but the adware slipped through again

Apple launched a notarization process for all apps and software created for macOS in February to weed out malware. Recently, a college student discovered adware with a full macOS notarization, according to WIRED

Mac computers were once impenetrable vaults, which led to few hackers attempting to infiltrate them. Those who tried would generally hit roadblocks. Today, Macs are hacked nearly as often as PCs, which lead to the February launch of Apple’s notarization process. 

This notarization is required for all apps and software designed for macOS. And if the notarization doesn’t exist, a user can’t run the software without a workaround. However, college student Peter Dantini purposefully downloaded malware, fully expecting his Mac to reject the installation. To his surprise, the well-traveled Shlayer adware installed on his machine without issue. 

Dantini alerted Apple of the notarized malware on Aug. 28, and Apple immediately revoked the notarization certificates. Unfortunately, two days later, the malware reappeared with a notarization from a different Apple Developer ID. Dantini again alerted Apple of the issue. 

Apple addressed the issue, saying, "Malicious software constantly changes, and Apple’s notarization system helps us keep malware off the Mac and allow us to respond quickly when it’s discovered.” The company continued, "Upon learning of this adware, we revoked the identified variant, disabled the developer account, and revoked the associated certificates. We thank the researchers for their assistance in keeping our users safe."

The fact that Apple quickly addressed the situation is reassuring, but this is proof that relying on Apple’s notarization system alone isn’t enough. While it can help prevent most malware, having a strong antivirus and a critical eye for iffy apps is key. 

Featured Resources

The challenge of securing the remote working employee

The IT Pro Guide to Sase and successful digital transformation

Free Download

VMware Cloud workload migration tools

Cloud migration types, phases, and strategies

Free download

Practices for maximising the business value of digital infrastructure Consumption-as- a-Service subscriptions

IDC PeerScape

Free Download

Container network security guide for dummies

Enforcing Kubernetes best practices

Free download

Recommended

El Salvador becomes latest target of Pegasus spyware
spyware

El Salvador becomes latest target of Pegasus spyware

13 Jan 2022
Mac shipments grew at twice the pace of PCs in 2021
Hardware

Mac shipments grew at twice the pace of PCs in 2021

13 Jan 2022
Apple becomes world's first $3 trillion company
business management

Apple becomes world's first $3 trillion company

4 Jan 2022
The IT Pro Products of the Year 2021: The year’s best hardware and software
Hardware

The IT Pro Products of the Year 2021: The year’s best hardware and software

31 Dec 2021

Most Popular

How to move Microsoft's Windows 11 from a hard drive to an SSD
Microsoft Windows

How to move Microsoft's Windows 11 from a hard drive to an SSD

4 Jan 2022
Synology DiskStation DS2422+ review: A cube of great capacity
network attached storage (NAS)

Synology DiskStation DS2422+ review: A cube of great capacity

10 Jan 2022
Microsoft Exchange servers break thanks to 'Y2K22' bug
email delivery

Microsoft Exchange servers break thanks to 'Y2K22' bug

4 Jan 2022