Objective-See details macOS App Translocation bypass
A researcher explains how Apple's App Translocation security feature broke his macOS tools and how to programmatically 'untranslocate' apps to restore functionality.
Sourceobjective-see.org — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
- Date
- The source gives no publication date; the date shown is the day Vorant added the brief.
This blog post from Objective-See's Patrick Wardle recounts his prior research into Gatekeeper bypasses (CVE-2015-3715 and CVE-2015-7024) that abused unsigned external content referenced by signed macOS applications, such as dylib hijacking and dynamic execution of unverified binaries. Apple's comprehensive fix for these issues, introduced in macOS Sierra as 'App Translocation' (Gatekeeper Path Randomization), mounts downloaded applications in a randomized, read-only location to prevent access to unverified external content.
While effective as a security mitigation, App Translocation broke legitimate functionality in several of the author's tools, including TaskExplorer, which needed to modify its own bundle (e.g., setuid an XPC service) at runtime. The author evaluates several Apple-suggested workarounds—refactoring with SMJobBless, moving the app bundle, creating installers, signed DMGs, and signed XIP archives—and finds each impractical or broken. He ultimately presents a technique using undocumented/private Security.framework APIs (SecTranslocateIsTranslocatedURL and SecTranslocateCreateOriginalPathForURL) to detect translocation, strip the com.apple.quarantine attribute from the original app copy, and relaunch it from its original location, effectively bypassing App Translocation's restrictions transparently to the end user.
This is a research/developer-focused writeup rather than an active threat report; it describes a legitimate technique to restore app functionality but also documents an approach that could theoretically be leveraged to circumvent a macOS security control using private APIs.
Mentioned in this report
Detection guidance
macOS App Removing Quarantine Attribute Before Execution
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects process removing com.apple.quarantine extended attribute from application bundle and subsequently executing it, bypassing Gatekeeper validation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: macOS App Removing Quarantine Attribute Before Execution
description: Detects removal of com.apple.quarantine extended attribute (xattr) followed
by execution of the same binary or a binary within the same bundle. This pattern
is used to strip Gatekeeper metadata and execute untrusted code.
tags:
- attack.defense-impairment
- attack.t1553.001
logsource:
category: process_creation
product: macos
detection:
selection_xattr_remove:
CommandLine|contains:
- xattr -d com.apple.quarantine
- xattr -rd com.apple.quarantine
selection_exec_after:
CommandLine|contains:
- '&&'
- ;
condition: selection_xattr_remove and selection_exec_after
falsepositives:
- Legitimate installer scripts or deployment tools removing quarantine for distribution
purposes
- User manual xattr removal during app installation workflow
level: medium
id: 66bf2869-9867-5e2a-920c-78b2e64c6b42
status: experimental
author: Vorant
macOS Process Relaunching From Non-Standard Path After Translocation Detection
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects process detecting App Translocation status and relaunching itself from original (non-randomized) application path, bypassing mount-based restrictions. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: macOS Process Relaunching From Non-Standard Path After Translocation Detection
description: Detects application detecting translocation status and then relaunching
itself from the original, non-randomized app path. Translocation mounts apps in
randomized /var/folders paths; relaunching from standard /Applications or user paths
after translocation detection indicates circumvention of App Translocation restrictions.
tags:
- attack.stealth
- attack.defense-impairment
- attack.t1553.001
- attack.t1574.001
logsource:
category: process_creation
product: macos
detection:
selection:
ParentImage|contains: /var/folders
Image|contains:
- /Applications/
- /Users/
Image|endswith: .app/Contents/MacOS
filter_installer:
Image|contains: Install
filter_dmg_mount:
ParentImage|contains: /Volumes/
condition: selection and not filter_installer and not filter_dmg_mount
falsepositives:
- Legitimate application launcher utilities
- DMG-based installers that extract and relaunch apps
level: medium
id: 1acd4e6c-c658-579b-83ba-47afd0ab28a5
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x15.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs