An Apple malware-flagging tool is “trivially” easy to bypass

As part of his Objective-See Foundation, which offers free and open source macOS security tools, Wardle has offered a similar persistence event notification tool known as BlockBlock for years. “Because I’ve written similar tools, I know the challenges my tools have faced, and I wondered if Apple’s tools and frameworks would have the same issues to work through—and they do,” he says. “Malware can still persist in a manner that is completely invisible.”

When Background Task Manager first debuted, Wardle discovered some more basic issues with the tool that caused persistence event notifications to fail. He reported them to Apple, and the company fixed the error. But the company didn’t identify deeper issues with the tool.

“We went back and forth, and eventually, they fixed that issue, but it was like putting some tape on an airplane as it’s crashing,” Wardle says. “They didn’t realize that the feature needed a lot of work.”

One of the bypasses Wardle presented on Saturday requires root access to a target’s device, meaning that attackers need to have full control before they can stop users from receiving persistence alerts. The bug related to this potential attack is important to patch because hackers can sometimes gain this level of access to a target and might be motivated to stop notifications so they can install as much malware as they want on a system.

More concerning is that Wardle also found two paths that don’t require root access to disable the persistence notifications Background Task Manager is supposed to send to the user and to security monitoring products. One of these exploits takes advantage of a bug in how the alerting system communicates with the core of a computer’s operating system known as the kernel. The other capitalizes on a capability that allows users, even those without deep system privileges, to put processes to sleep. Wardle found that this capability can be manipulated to disrupt persistence notifications before they can get to the user.

Wardle says he chose to release these bugs at Defcon without first notifying Apple because he had already notified the company about flaws in Background Task Manager that could have led it to improve the tool’s overall quality more comprehensively. He adds, too, that bypassing this monitoring simply brings the state of macOS security back to what it was a year ago, before this feature debuted. But he notes that it’s problematic when Apple releases monitoring tools that seem rushed or need more testing, because it can give users and security vendors a false sense of security.

This story originally appeared on wired.com.