{"id":37986,"date":"2022-12-26T15:32:18","date_gmt":"2022-12-26T20:32:18","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=37986"},"modified":"2022-12-26T16:13:23","modified_gmt":"2022-12-26T21:13:23","slug":"gatekeepers-achilles-heel","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2022\/12\/26\/gatekeepers-achilles-heel\/","title":{"rendered":"Gatekeeper&rsquo;s Achilles Heel"},"content":{"rendered":"<p><a href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/12\/19\/gatekeepers-achilles-heel-unearthing-a-macos-vulnerability\/\">Jonathan Bar Or<\/a>:<\/p>\n<blockquote cite=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/12\/19\/gatekeepers-achilles-heel-unearthing-a-macos-vulnerability\/\">\n<p>Considering symbolic links are preserved in archives and aren&rsquo;t assigned with quarantine attributes&mdash;we looked for a mechanism that could persist different kinds of metadata over archives.<\/p>\n<p>After some investigation, we discovered a way to persist important file metadata through a mechanism called AppleDouble.<\/p>\n<p>[&#8230;]<\/p>\n<p>Equipped with this information, we decided to add very restrictive ACLs to the downloaded files. Those ACLs prohibit Safari (or any other program) from setting new extended attributes, including the <em>com.apple.quarantine<\/em> attribute.<\/p>\n<\/blockquote>\n\n<p>This is pretty clever and was fixed in macOS 12.6.2 and in Ventura.<\/p>\n\n<p>Previously:<\/p>\n<ul>\n<li><a href=\"https:\/\/mjtsai.com\/blog\/2022\/12\/05\/powerdir-macos-tcc-vulnerability\/\">Powerdir macOS TCC Vulnerability<\/a><\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"<p>Jonathan Bar Or: Considering symbolic links are preserved in archives and aren&rsquo;t assigned with quarantine attributes&mdash;we looked for a mechanism that could persist different kinds of metadata over archives. After some investigation, we discovered a way to persist important file metadata through a mechanism called AppleDouble. [&#8230;] Equipped with this information, we decided to add [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"apple_news_api_created_at":"2022-12-26T20:32:20Z","apple_news_api_id":"efb8b333-57e3-4a4b-813f-559f047c2445","apple_news_api_modified_at":"2022-12-26T21:13:26Z","apple_news_api_revision":"AAAAAAAAAAAAAAAAAAAAAw==","apple_news_api_share_url":"https:\/\/apple.news\/A77izM1fjSkuBP1WfBHwkRQ","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":"\"\"","apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"footnotes":""},"categories":[2],"tags":[131,1902,547,465,30,2077,2223,48],"class_list":["post-37986","post","type-post","status-publish","format-standard","hentry","category-technology","tag-bug","tag-extended-attributes","tag-permissions","tag-gatekeeper","tag-mac","tag-macos-12","tag-macos-13-ventura","tag-security"],"apple_news_notices":[],"_links":{"self":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/37986","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/comments?post=37986"}],"version-history":[{"count":1,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/37986\/revisions"}],"predecessor-version":[{"id":37987,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/37986\/revisions\/37987"}],"wp:attachment":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/media?parent=37986"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/categories?post=37986"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/tags?post=37986"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}