IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Common malware slipped past the macOS notarization process twice

Apple immediately revoked the notarization, but the adware slipped through again

Apple launched a notarization process for all apps and software created for macOS in February to weed out malware. Recently, a college student discovered adware with a full macOS notarization, according to WIRED

Mac computers were once impenetrable vaults, which led to few hackers attempting to infiltrate them. Those who tried would generally hit roadblocks. Today, Macs are hacked nearly as often as PCs, which lead to the February launch of Apple’s notarization process. 

This notarization is required for all apps and software designed for macOS. And if the notarization doesn’t exist, a user can’t run the software without a workaround. However, college student Peter Dantini purposefully downloaded malware, fully expecting his Mac to reject the installation. To his surprise, the well-traveled Shlayer adware installed on his machine without issue. 

Dantini alerted Apple of the notarized malware on Aug. 28, and Apple immediately revoked the notarization certificates. Unfortunately, two days later, the malware reappeared with a notarization from a different Apple Developer ID. Dantini again alerted Apple of the issue. 

Apple addressed the issue, saying, "Malicious software constantly changes, and Apple’s notarization system helps us keep malware off the Mac and allow us to respond quickly when it’s discovered.” The company continued, "Upon learning of this adware, we revoked the identified variant, disabled the developer account, and revoked the associated certificates. We thank the researchers for their assistance in keeping our users safe."

The fact that Apple quickly addressed the situation is reassuring, but this is proof that relying on Apple’s notarization system alone isn’t enough. While it can help prevent most malware, having a strong antivirus and a critical eye for iffy apps is key. 

Featured Resources

Join the 90% of enterprises accelerating to the cloud

Business transformation through digital modernisation

Free Download

Delivering on demand: Momentum builds toward flexible IT

A modern digital workplace strategy

Free download

Modernise the workforce experience

Actionable insights and an optimised experience for both IT and end users

Free Download

The digital workplace roadmap

A leader's guide to strategy and success

Free Download

Recommended

Best business smartphones 2022: The top handsets from Apple, Samsung, Google and more
Mobile

Best business smartphones 2022: The top handsets from Apple, Samsung, Google and more

23 Jun 2022
Best business laptops 2022: Acer, Asus, Dell and more
Laptops

Best business laptops 2022: Acer, Asus, Dell and more

13 Jun 2022
Apple faces a catch-22 decision with iPhones and USB-C
Policy & legislation

Apple faces a catch-22 decision with iPhones and USB-C

8 Jun 2022
Apple overhauls SwiftUI navigation and brings a score of new features to developers at WWDC 2022
software development

Apple overhauls SwiftUI navigation and brings a score of new features to developers at WWDC 2022

7 Jun 2022

Most Popular

Actively exploited server backdoor remains undetected in most organisations' networks
cyber attacks

Actively exploited server backdoor remains undetected in most organisations' networks

1 Jul 2022
Former Uber security chief to face fraud charges over hack coverup
data breaches

Former Uber security chief to face fraud charges over hack coverup

29 Jun 2022
Why India wants to become a chipmaking powerhouse
components

Why India wants to become a chipmaking powerhouse

28 Jun 2022