first reported<\/a>, cybersecurity firm Intego recently spotted malware authors testing out what the researchers call OSX\/Linker, which uses a variation on Cavallarin\u2019s proof-of-concept to sneak malicious code past Gatekeeper\u2019s defenses. While it looks like this specific attempt hasn\u2019t yet been used in the wild, its existence points to a looming threat to Mac owners\u2014and Apple\u2019s apparent reluctance to fix it.<\/p>\nApple first introduced Gatekeeper in 2012, as part of OS X Mountain Lion. It works by scanning apps that you download from outside of Apple\u2019s Mac App Store to check if they\u2019ve been \u201ccode-signed,\u201d a process that verifies whether software comes from the developer it claims to, and that it hasn\u2019t been tampered with. Gatekeeper also maintains a blacklist of known malware, to flag problematic downloads before you open them.<\/p>\n
What Cavallarin realized, and what hackers have since glommed on to, is that Gatekeeper doesn\u2019t treat all files equally. Specifically, it considers applications coming from external drives, or shared over a network, as safe. So if you can trick someone into opening a .zip file that contains a so-called symbolic link to a Network File System server you control, you can place whatever malware you want on the victim\u2019s system without Gatekeeper batting an eye. It\u2019s a little bit like getting past the bouncer because you\u2019re dressed in the uniform of the catering company.<\/p>\n
If that still sounds like a technical jumble, here\u2019s a video Cavallarin made that shows how it unfolds in practice.<\/p>\n
![](\"https:\/\/media.wired.com\/photos\/5d13dfe2a38afe00081d6f63\/master\/pass\/security_macos_1125671756.jpg\"\/)
<\/p>\n