Revoked, Not Dead: When CDHash Revocation Fails to Kill

Gatekeeper is the macOS first line of defense for software obtained outside the App Store. It checks code signatures, notarization tickets, and whether a binary's CDHash has been revoked. The talk opens with recent macOS malware that reached code execution through trusted routes such as AppleScript run inside Script Editor, Automator workflows, Terminal commands, and malicious Xcode build phases, all of which avoided a Gatekeeper block.

The speaker then explains how a CDHash is built from per-page hashes in the code directory, and how notarization tickets tied to those hashes can be queried from Apple's lookup service and parsed. Parsing the ticket flags shows whether a hash was notarized or revoked, and whether the revocation was issued after notarization or for an ad hoc signed build. The central finding is that Gatekeeper verifies only the top-level app when it is first opened and caches that verdict. A revoked ad hoc signed app nested inside an already approved app bundle can therefore execute without a fresh revocation check. Demonstrations used a third-party app and a Script Editor template as the outer bundle. Apple fixed the issue in macOS 26.

The main takeaway is that revocation is not a guaranteed kill switch for code that was previously allowed. Defenders can look for nested bundles whose signatures do not match their parent app, and review the cached system policy records for revoked CDHash entries.