The Wild World of macOS Installers

Tony Lambert of Red Canary opens by defining an installer broadly as anything that writes executable code to disk, and notes that on macOS the gap between an installer and malware is mostly a matter of trust. He walks through the platform's installer components, including the command-line installer, the GUI installer that launches from launchd, and installd, which stages payloads in randomized sandbox folders before merging them into the file system.

The middle of the talk covers where code can hide. Package pre- and postinstall scripts can be written in shell, Python, Perl or even compiled binaries, and some packages contain no payload at all, only scripts that fetch content later. Distribution XML can call system.run to execute commands with root privileges, and disk images mounted under volumes with misleading names like player or installer are common. For developer libraries, he showed how setup.py in pip, version.rb in RubyGems and npm install scripts can run arbitrary code at install time, with persistence and extra downloads as the main red flags.

For defenders, he suggested hunting for unusual child processes of the installer and package script services, watching for hdiutil attach activity, and flagging installs that write launch agents or shell profiles. He acknowledged that legitimate packaging varies so widely that the signal is noisy, and cautioned against trusting logos or branding, since lookalike assets are common. Checking the vendor's code signature is the more reliable step, though he noted that malicious actors still obtain signing certificates.