Researchers at Okta Security have stumbled across something big. Recently, they discovered a flaw in Apple’s OS that would have allowed hackers to completely undermine Apple’s code signing process.
While at first glance that doesn’t sound so bad, the implications are terrifying. In a nutshell, code signing uses cryptographic “signatures” to verify and validate code. If code bears the digital signature, it is considered trusted. If it’s trusted, then it’s given an automatic free pass, straight into the heart of any system.
Unfortunately, this flaw in Apple’s code signing process dates back more than a decade. It was only recently discovered, and purely by chance at that.
An extensive forensic analysis has turned up no evidence suggesting that this exploit was ever used for nefarious purposes, which is the one silver lining in all of this.
Upon discovering the flaw, Okta personnel reached out to Apple and other vendors who could have been impacted by the flaw, including tech giants like Google, Facebook and also smaller players like VirusTotal, Objective Development, Yelp, and Carbon Black.
Apple moved swiftly and has since fixed the issue, so this one can be considered a bullet dodged.
Josh Pitts, an Okta engineer, sums the issue up:
“Different types of tools and products use code signing to implement actionable security; this includes whitelisting, antivirus, incident response and threat hunting products. To undermine a code signing implementation for a major OS would break a core security construct that many depend on for day to day security operations.”
A completely fair assessment. Thankfully (at least in this particular case), although the issue was hiding in plain sight, it does not appear to have been exploited before being fixed. We won’t always be so lucky.
