RansomWhere? adds Mac App Store trust logic

Objective-See details how RansomWhere? will verify Mac App Store receipts to reduce false positives, referencing the KeRanger ransomware as a signed-but-non-App-Store example.

This is a technical blog post from Objective-See explaining how to programmatically verify whether a macOS application originated from Apple's Mac App Store by validating its embedded receipt. The author walks through code using Apple's Security framework APIs (SecStaticCodeCheckValidity, CMSDecoder, SecAsn1Coder) to check code signing, locate and decode the app receipt, and validate bundle ID, version, and SHA1 hash matches against the receipt data.

The motivation is to improve RansomWhere?, a generic OS X ransomware detection tool, by allowing version 1.1 to trust processes backed by legitimate Mac App Store applications, thereby reducing false positives. The author references the KeRanger ransomware as an example of malware that was signed with a legitimate Apple Developer ID but was not distributed via the App Store, demonstrating why code-signing checks alone are insufficient and receipt validation is needed.

This is an informational/educational research post with no active threat or campaign; it discusses defensive tooling development rather than an ongoing attack. Severity is low as this is a research/tooling article, not an active threat.

Source reporting: https://objective-see.org/blog/blog_0x10.html