Silent Replacement of Trusted macOS App Executables

查看原文 / View Original 编辑 / Edit

Silent Replacement of Trusted macOS App Executables

macOS 受信任应用可执行文件的静默替换

2026-07-23 by Talal Haj Bakry and Tommy Mysk 2026年7月23日，作者：Talal Haj Bakry 和 Tommy Mysk

A vulnerability in macOS allows an attacker to silently replace the main executable of any application downloaded from the web without requiring elevated privileges. As a result, trusted applications can be made to execute attacker-controlled code without triggering security warnings when relaunched. Apple assessed the reported behaviour as not requiring a security fix. macOS 中存在一个漏洞，允许攻击者在无需提升权限的情况下，静默替换从网络下载的任何应用程序的主可执行文件。因此，受信任的应用程序在重新启动时，可能会在不触发任何安全警告的情况下执行攻击者控制的代码。苹果公司评估后认为，该报告的行为无需进行安全修复。

Affected Platforms

受影响的平台

  • macOS Tahoe 26.0.0 – 26.5.2
  • macOS Golden Gate 27 beta 1, 2, 3, and 4
  • Earlier versions of macOS are likely affected as well, but have not been tested.
  • macOS Tahoe 26.0.0 – 26.5.2
  • macOS Golden Gate 27 beta 1, 2, 3, 和 4
  • macOS 的早期版本也可能受到影响，但尚未经过测试。

Summary

摘要

macOS provides several safeguards to prevent applications and scripts from tampering with other installed applications. In this post, we show a bug in macOS that allows an attacker to: macOS 提供了多种保护措施，以防止应用程序和脚本篡改其他已安装的应用程序。在这篇文章中，我们展示了 macOS 中的一个漏洞，该漏洞允许攻击者：

  • Silently replace an application’s main executable under /Contents/MacOS/ without triggering an authorization prompt.
  • Relaunch the modified application normally, without displaying any security warnings.
  • Impersonate the trusted application in system permission prompts to request access to Keychain secrets and files protected by Transparency, Consent, and Control (TCC), including those inside ~/Desktop and ~/Documents.
  • 在不触发授权提示的情况下，静默替换 /Contents/MacOS/ 下的应用程序主可执行文件。
  • 正常重新启动修改后的应用程序，且不显示任何安全警告。
  • 在系统权限提示中冒充受信任的应用程序，以请求访问钥匙串（Keychain）机密以及受“透明度、同意和控制”（TCC）保护的文件，包括 ~/Desktop 和 ~/Documents 中的文件。

The attack requires only code execution as the current user, and does not require elevated privileges. 该攻击仅需以当前用户身份执行代码，无需提升权限。

Summary for Non-Technical Readers

非技术读者摘要

We found a macOS security issue that Apple looked into but decided not to fix. If you run a malicious app or script on your Mac, an attacker could: 我们发现了一个 macOS 安全问题，苹果公司在调查后决定不予修复。如果您在 Mac 上运行了恶意应用程序或脚本，攻击者可以：

  • Secretly replace trusted apps you already have installed from the web with malicious versions.
  • Request permissions to access private data on behalf of those trusted apps, including files in places you expect to be private, such as your Desktop or Documents folders, or your Keychain.
  • 秘密地将您从网络上安装的受信任应用程序替换为恶意版本。
  • 代表这些受信任的应用程序请求访问私有数据的权限，包括您认为私密位置（如桌面或文档文件夹）中的文件，或您的钥匙串。

Replacing a trusted app requires neither your Mac’s password nor any special approval, and it can happen entirely in the background. Accessing protected data still requires your approval, but the macOS system prompts show the trusted app’s name and icon, making the requests appear to come from the real app. 替换受信任的应用程序既不需要您的 Mac 密码，也不需要任何特殊批准，且整个过程可以在后台完全静默完成。访问受保护的数据仍然需要您的批准，但 macOS 系统提示会显示受信任应用程序的名称和图标，使这些请求看起来像是来自真正的应用程序。

Background: macOS Application Bundles

背景：macOS 应用程序包

On macOS, apps are distributed as application bundles, which are directory structures that appear as a single .app file in Finder. An application bundle contains the app’s executable, resources such as icons and artwork, embedded frameworks and libraries, and metadata. Apple’s documentation describes the bundle format in more detail. 在 macOS 上，应用程序以“应用程序包”（Application Bundles）的形式分发，这是一种在访达（Finder）中显示为单个 .app 文件的目录结构。应用程序包包含应用程序的可执行文件、图标和艺术资源、嵌入式框架和库以及元数据。苹果的文档对包格式有更详细的描述。

When a user downloads an app from the Internet and launches it for the first time, macOS verifies its code signature and notarization and applies Gatekeeper policies to determine whether the app is trusted to run. 当用户从互联网下载应用程序并首次启动时，macOS 会验证其代码签名和公证情况，并应用 Gatekeeper 策略来确定该应用程序是否可信。

After the app is installed (for example, by dragging it into /Applications) and opened, macOS also protects the contents of its bundle. Other applications and scripts, even those running with administrator privileges, cannot modify files inside it. macOS blocks any such attempt and alerts the user that it prevented the modification. 在应用程序安装（例如拖入 /Applications 文件夹）并打开后，macOS 还会保护其包内容。其他应用程序和脚本，即使是以管理员权限运行的，也无法修改其中的文件。macOS 会阻止此类尝试，并提醒用户已阻止该修改。

Archive and Restore

归档与还原

We accidentally discovered a scenario in which any application or script running with the current user’s privileges can silently replace the main executable of an application bundle and launch the modified application without triggering a code-signature or security warning. 我们偶然发现了一种情况：任何以当前用户权限运行的应用程序或脚本，都可以静默替换应用程序包的主可执行文件，并启动修改后的应用程序，而不会触发代码签名或安全警告。

The issue is reproducible when: 该问题在以下情况下可复现：

  • The app was downloaded from the web rather than installed through the Mac App Store.
  • The app has already been launched at least once, allowing Gatekeeper to complete its initial verification.
  • The attacker already has code execution as the current user, for example through a malicious app or downloaded script.
  • 应用程序是从网络下载的，而非通过 Mac App Store 安装。
  • 应用程序至少已启动过一次，允许 Gatekeeper 完成其初始验证。
  • 攻击者已拥有当前用户的代码执行权限，例如通过恶意应用程序或下载的脚本。

We’ll use Signal as an example. To be clear, this is not a Signal vulnerability. Signal is simply a convenient demonstration target because it is widely trusted and distributed outside the Mac App Store. The same behaviour affects other apps downloaded from the web, including Brave Browser, Cursor, Mullvad Browser, Proton Mail, Slack, Visual Studio Code, Xcode, and many others. 我们将以 Signal 为例。需要明确的是，这不是 Signal 的漏洞。Signal 只是一个方便的演示目标，因为它广受信任且在 Mac App Store 之外分发。同样的行为也会影响其他从网络下载的应用程序，包括 Brave Browser、Cursor、Mullvad Browser、Proton Mail、Slack、Visual Studio Code、Xcode 等等。

After installing Signal and launching it once, macOS prevents subsequent modifications to its application bundle. You can verify this by running: 在安装 Signal 并启动一次后，macOS 会阻止对其应用程序包的后续修改。您可以通过运行以下命令进行验证：

% touch /Applications/Signal.app/Contents/MacOS/Signal
touch: /Applications/Signal.app/Contents/MacOS/Signal: Operation not permitted

Even with sudo, you still cannot modify the application’s main executable: 即使使用 sudo，您仍然无法修改应用程序的主可执行文件：

% sudo touch /Applications/Signal.app/Contents/MacOS/Signal
touch: /Applications/Signal.app/Contents/MacOS/Signal: Operation not permitted

However, archiving the application bundle with tar, deleting the original, and extracting the archive back into /Applications changes this behaviour: 然而，使用 tar 对应用程序包进行归档、删除原始文件并将归档文件解压回 /Applications 后，这种行为会发生改变：

% cd /Applications/
% tar cf .Signal.tar Signal.app
% rm -rf Signal.app
% tar xf .Signal.tar -C /Applications

The restored app launches normally, despite being a different copy of the original bundle. What’s surprising is that its contents can be modified without triggering an authorization prompt: 还原后的应用程序可以正常启动，尽管它是原始包的一个不同副本。令人惊讶的是，其内容可以在不触发授权提示的情况下被修改：

% touch /Applications/Signal.app/Contents/MacOS/Signal
%

It works! 成功了！

At this point, replacing the app’s main executable is straightforward. The modified app continues to launch, and macOS displays neither a Gatekeeper warning nor any indication that its bundle has been altered. 此时，替换应用程序的主可执行文件变得非常简单。修改后的应用程序可以继续启动，macOS 既不会显示 Gatekeeper 警告，也不会有任何迹象表明其包已被篡改。

← 返回新闻列表 / Back to news list