OSX signed malware FYI

[salzerrw]

Fresh off the CNET presses.

Help protect yourself from signed malware in OS X | MacFixIt - CNET Reviews

 

[vansmith]

It was able to get past Apple's GateKeeper settings since it was developed under and signed with a valid Apple Developer ID under the name of Rajinder Kumar. According to F-Secure, the developer ID for this individual has since been revoked, but before this news hit, the malware created with his ID was able to infect and run on a few systems, including test systems controlled by a number of security firms.

Given this, I'm not sure why this is news. If he had actually managed to circumvent the process, it would be news. In this case, all he did was sign malware with a perfectly legitimate certificate which was revoked, rendering it un-installable if you have GK on. GateKeeper worked exactly as it was supposed to - it let signed software run and precluded unsigned software from doing so.

 

[harryb2448]

Much Ado About Nothing as the Bard wrote!