(I don’t know how Sparkle operates; if it only does the extraction after signature validation I guess an attack would be pretty hard to pull off even if you have a zero day in the archive decompressor.)
Step 1: find zero day vulnerability in obscure archive format
Step 2: add said archive format to the most popular 3rd party macOS software update framework
Step 3: ???
Our product deleted some “malware” in Proxygen’s container when I downloaded it in my VM - it still got delivered through the proxy so all is good, I was just surprised it landed on disk at all :-) /cc @pasi@mastodon.social







