Researchers Talal Haj Bakry and Tommy Mysk discovered a vulnerability in macOS that allows an attacker to replace already installed apps with malicious versions that look indistinguishable from the real app.
A huge reason why I always implement Santa on all new installs of MacOS. https://santa.dev/
Binary Authorization | Santa
It can be discussed, but generally, if attacker can launch random code as the legit user — the game is already lost.
Apple concluded that the reported behaviour does not constitute a security issue for the following reasons:
- The proof of concept replaces the entire application bundle rather than modifying an existing signed executable.
- The attack requires code execution as the current user and only affects applications owned by that user.
- The replacement executable does not inherit the original application’s entitlements or previously granted TCC permissions, requiring the user to approve new authorization prompts.
- Apple considers convincing a user to approve these prompts to be a matter of social engineering rather than a bypass of TCC or other security mechanisms.
- Gatekeeper is designed to evaluate downloaded applications before their first launch and is not intended to protect files already owned and modified by the current user.