Bundles of Joy: Breaking macOS via Subverted Application Bundles
Patrick Wardle dissects CVE-2021-30657, a zero-click logic bug in macOS application bundles that completely bypassed Apple File Quarantine, Gatekeeper, and Notarization.
Summary
Apple's Layered macOS Execution Protections
Modern macOS systems enforce strict security gates on downloaded software, combining File Quarantine attributes, Gatekeeper signature checks, and mandatory Cloud Notarization.
Dissecting CVE-2021-30657: The Shroot Zero-Day
Patrick Wardle investigates a critical logic flaw discovered in macOS Big Sur, where maliciously crafted application bundles lacking a standard `Info.plist` completely bypassed Gatekeeper.
In-the-Wild Malware Weaponization (Shlayer)
Adversary campaigns immediately weaponized this vulnerability, distributing unnotarized malware installers that executed instantly with a single double-click without triggering OS security prompts.
Defensive Lessons in OS Architecture and Logic Validation
Wardle examines Apple's subsequent kernel patches and shares behavioral heuristics for security analysts to detect anomalous bundle structures.
Related talks
Main Stage·52 min
Cedric Owens
Cedric Owens details modern attack paths in non-Active Directory macOS environments, including Gatekeeper bypasses, cloud IdaaS targeting, and post-exploitation tradecraft.
Briefings·21 min
Fengyu Liu · YouKun Shi · Tian Chen · Bocheng Xiang · Junyao He · Qi Li · Guangliang Yang · Yuan Zhang · Min Yang
Microservice architecture has become increasingly popular for building scalable and maintainable applications.
nullcon·48 min
Analysts investigate attack surfaces and defenses concerning Berlin 2023 | The Achilles Heel Of The macOS Gatekeeper by Jonathan Bar Or.