Familiar with App Notarization? Well, most people aren’t. It is a newly introduced formal security protection protocol introduced by Apple Inc., earlier this year.
As Apple says in their overview, “Notarization gives users more confidence that the Developer ID-signed software you distribute has been checked by Apple for malicious components. Notarization is not App Review. The Apple notary service is an automated system that scans your software for malicious content, checks for code-signing issues, and returns the results to you quickly. If there are no issues, the notary service generates a ticket for you to staple to your software; the notary service also publishes that ticket online where Gatekeeper can find it.
When the user first installs or runs your software, the presence of a ticket (either online or attached to the executable) tells Gatekeeper that Apple notarized the software. Gatekeeper then places descriptive information in the initial launch dialog to help the user make an informed choice about whether to launch the app.”
Even after all the security measures Apple has taken in order to secure the app store, cyber criminals have been able to pass malicious apps through the gatekeeper (Notarization process) second time in less than a year. This clearly indicates that Apple has some loopholes in the notarization process that urgently need to be filled.
Apple’s notarization process is well known in the developer community for conducting a series of automated security scans that can detect malware and other malicious codes. Approved apps are marked as Notarized and are added to Apple’s whitelist, therefore, making users feel more secure about downloading and using apps from the App Store.
App notarization has been a mandatory process for all apps that are required to run on the new Apple updates across the board.
Apple’s app notarization process is very similar to Bouncer, Android’s app scanner for Google Play, but is nearly not as perfect.
Till date, 40 apps have managed to pass through Apple’s notarization process. These apps were infected with Shlayer Trojan and the BundleCore Adware.
In addition to the 40 apps, Joshua Long, Chief Security Analyst for Mac security software manufacturer Intego, said they noticed 6 new yet malicious apps that were able to make their way into the app store, passing through the notarization process.
