Bombastically Abominating Bomshellz

The talk opens with an overview of Gatekeeper, the macOS control that checks code signing and notarization before an app launches, and why attackers want to slip past it. The speakers, both from Jamf Threat Labs, describe how unsigned indie games from a game distribution site were getting through when downloaded with Safari, while Chrome and Firefox downloads were blocked as expected.

Tracing the download with Endpoint Security events, they found that Safari's sandbox unpacks archives and applies the quarantine attribute to the extracted files. A zip archive with its top-level header removed left the bill of materials out of sync with the contents, so the app bundle directory never received the quarantine attribute. Gatekeeper only inspects that directory, so it never checked the app. The second flaw sits in Archive Utility. When an archive holds two or more top-level items, the utility wraps them in a folder named after the archive, and that wrapper is never quarantined. Naming the archive with an .app extension therefore produced an unchecked application. Apple patched the Safari issue in macOS 12.3 and the Archive Utility issue in 12.5.

For defenders, the speakers outlined Endpoint Security detections: watching rename events where the source is an archive service temporary folder and the destination ends in .app, and flagging extracted apps that are unsigned or ad hoc signed. The main takeaway is that the quarantine attribute on a bundle is not a reliable signal, and that archive extraction deserves monitoring alongside downloads.