A flaw in Apple’s Gatekeeper security feature isn’t fixed, according to the security researcher who found it. Turns out Apple wasn’t fully patching holes, just blocking specific bits of malware from getting through.
“Even on a fully-patched OS X 10.11.2 system, Gatekeeper is trivial to bypass,” wrote Parick Wardle, who first revealed the flaw, in a blog post demonstrating that it is very much still there. A video shows a man-in-the-middle attack, injecting malware into an unencrypted download of Kaspersky Internet Security for Mac. The malware installed alongside the security software.
Gatekeeper is an OS X security feature that, by default, blocks all applications but those downloaded from the Mac App Store, or (optionally) apps from “identified developers.” The idea here is to block malware on Macs: only software developers Apple has approved can get software running on the platform.
But Wardle found a workaround last year. To simplify, an authorized program — such as Kasperskey — is modified to launch a bit of malware when opened. If that malware happens to be in the same folder as the authorized app, it will launch.
Apple seemingly patched the problem in December, but when Wardle reverse-engineered the patch he found it wasn’t comprehensive. Apple had blacklisted the tools Wardle used to bypass Gatekeeper, but hadn’t solved the underlying issue — meaning would-be malware makers needed only to find new tools.
Wardle has been in touch with Apple’s security team, Engadget reports, and says a comprehensive fix is on the way.
And Wardle is working on a fix of his own. “I’ll be releasing a personal tool that can generically thwart such attacks, protecting OS X users,” he wrote in his blog post.
Until one or both of these fixes come online, users can stay safe by sticking only to downloading apps from the Mac App Store or trusted sites that are using HTTPS encryption. That’s probably a good idea even after this problem is patched.
Mozilla is giving Firefox’s Smart Window two new tricks. If you haven’t tried it yet, Smart Window is an optional AI mode in Firefox with a built-in chat that helps you get things done while you browse. With this update, it can fill out online forms using details from your tabs and keep an eye on websites for you.
Tired of typing the same details into every form?
The absolutely absurd idea of putting a touchscreen display on a mouse isn't exactly new. Turtle Beach already did it with its Command Series MC7, which features a 2.25-inch control screen. But apparently, even that wasn't ridiculous enough for Arctic Fox Technologies. Its new Super Mouse looks like someone took the chunky old Atari ST mouse, slapped a touchscreen and scroll wheel on it, and called it an upgrade.
The result is a rather unusual-looking mouse that is now on Kickstarter, starting at $199. And as ridiculous as it looks, some of its features are genuinely intriguing.
Apple is less than a day away from launching its highly anticipated OLED MacBook Pro with a touch-sensitive screen. But it appears that the upgrade is going to cost a pretty penny. According to a report by Bloomberg, Apple is reportedly eyeing a starting price of $2,899 for the 14-inch MacBook Pro, while the 16-inch version could start at $3,399 in the US.
"At $2,899, the 14-inch model would mark the highest starting price for a new MacBook Pro model, surpassing the $2,799 Apple charged for a 17-inch version introduced in 2006," says the report. The report claims that Apple is targeting a minimum price hike of $400 for its upcoming redesigned 14-inch and 16-inch MacBook Pro models.