#Apple safari web back browser risk zip file#

After trying a few different combinations, we were indeed able to skip the Gatekeeper prompts when our custom zip file was downloaded via Safari. We surmised the way in which it was re-zipping the application was causing the bypass to accidentally occur, having no reason to believe that the website creators were aware of the bug.įor testing purposes, we built an application and ran it through the Butler command-line tool. Butler analyzes an uploaded application and re-zips it before hosting it for download. This tool allows them to easily manage the games which are hosted on their account. Developers are encouraged to use an open-source Go-Lang command-line tool called Butler. This of course raised the question, “What’s so special about the zip files hosted on this website?” Fortunately, we were able to answer this question thanks to the great documentation that the site provides as to how games are handled. Since the bug only seems to exist when an auto-extraction occurs, we suspected a bug in this process. The process responsible for automatically unzipping downloaded applications is. By default, Safari has a built-in feature that is enabled that will automatically unzip applications held within a zip file after downloading them. We did note that many applications were delivered in the form of a zip file. Upon further testing, we noted that we would only receive the expected Gatekeeper prompts if the application was downloaded from a third-party web browser, such as Google Chrome.

This made us very curious because not only were these applications being downloaded from the Internet but most were completely unsigned. After downloading and opening a handful of games, we noticed that many would not trigger an alert from Gatekeeper. While investigating websites that host a large number of third-party macOS applications, we came across the popular game hosting website itch.io, where many independent game developers host their games. After the user has chosen to run the program - regardless of the Gatekeeper prompts - the operating system will no longer prompt the user when launching this specific application in the future. This is all due to the fact that applications downloaded for the first time have an extended attribute placed on them titled.

Apple safari web back browser risk