Home

Podfeet Podcasts

Security Bits logo - a green padlock with the words Security Bits to the right and in tiny letters below ithat it says 10101010 indicating a digital lock

Security Bits — 24 May 2026

  • by Bart Busschots

    • Feedback & Followups

    Listener Questions

    From Allison — ChatGPT Malware?

    Allison posted a screenshot on Slack showing her Mac blocking ChatGPT as malware — what happened?

    Popup explaining ChatGPT is malware and has been moved to the trash.
    ChatGPT is Malware?

    TL;DR — OpenAI fell prey to a supply-chain attack and lost control of one of their software signing certificates, so they marked the certificate as compromised, and rushed out a new version of ChatGPT signed with a safe certificate.

    One of the things Apple’s Gatekeeper malware protection feature does is check the digital signatures on every app before the system launches it. This provides two important protections:

    1. It gives Apple a quick mechanism for blocking known-bad software simply — if an app is signed with a revoked cert, block it! No need to develop some kind of AV-style pattern matching, just check the cert!
    2. It detects and blocks apps that have changed since they were signed — either you were tricked into installing a booby-trapped version of the app, or, something nasty ran on your Mac for long enough to inject new code into a legitimate app you had installed.

    Once OpenAI discovered they had lost the private key controlling their code signing certificate, they revoked it immediately. They also re-signed their app as quickly as they could and pushed out a software update, allowing legitimate versions of ChatGPT to try update themselves to the known-good version.

    Neither certificate revocations nor software updates propagate instantaneously, so we now have a race condition! Would Allison’s Mac get the ChatGPT update before her Mac learned about the certificate revocation?

    As it happens it seems both sort of happened — the software update process got far enough that the new app was on her Mac, but had clearly not completed all the way. The end result, Allison was told a malicious copy of ChatGPT had been moved to the trash, and, when she tried to launch ChatGPT again it started fine!

    There are infinitely many ways for apps to update themselves, but any update mechanism that starts while an app is running needs to briefly have two versions of the app on your system at the same time — you can’t change running code!

    Apple’s app store gets around this by forcing your to quit an app before you can update it, which works because the store app is not the app itself.

    Firefox has to deal with this problem somehow, because Firefox updates itself without the help of the App Store app. What Firefox does it download updates in the background as soon as they becomes available, then, as it starts, it checks for a waiting copy. If it finds one, it launches a helper app, and exists, letting the helper app do the switcheroo, before it then starts Firefox for you. What you exerience as a user is a slightly slower startup, and you might notice the dock icon appear, disappear briefly, then re-appear.

    Chrome on the other hand helps itself to your resources and runs an always-on background app that does nothing but check for updates. It then downloads any updates Google pushes, and checks if Chrome is running, if not, it does the switcheroo, if it is, it waits! The down-side is you have an always-on process consuming your RAM, and if that process has a vulnerability or a bug, your Mac is always running the vulnerable code, even when you quit Chrome. For about a year Mac users running Chrome complained their RAM kept vanishing, and it was eventually traced to a bug in the Chrome updater that forgot to free a piece of memory after use, causing it to grow and grow and grow until you rebooted your Mac!

    If you’re curious why certificate revocations are not checked in real-time, there are a few reasons. Before we look at why it’s not done in real time for app launches, I do want to emphasise that it is possible, at least for now.

    Certificate Authorities currently provide URLs for querying certificate statuses using OCSP, the Online Certificate Status Protocol.

    So, why not use OCSP?

    1. You need to be able to launch apps while not connected to the internet!
    2. Checking every cert’s latest status each time would slow down your app launches and flood certificate authorities with real-time certificate status checks
    3. Checking every time is a privacy leak — the certificate authority’s certificate status protocol servers would see the App cert and the IP of the machine running it each time an app was started, allowing them to track app usage by specific IPs, something data brokers would pay big money for!

    Why did I hedge my mention of OCSP with for now? Precisely because of the privacy concerns, it’s being phased out! It is being replaced by a privacy-protecting, less real-time protocol that uses lists of hashed revoked certificates structured in a computationally efficient data structure that can be searched really efficiently.

    Links

    ❗ Action Alerts

    Worthy Warnings

    Notable News

    Interesting Insights

    Palate Cleansers

    • From Allison: LeoLabs — platform.leolabs.space/…
      • Cool animation of current satellites, instruments, and debris. You can zoom in and select a specific satellite and follow along in its path, and (if you turn off debris) you can see satellites by country of origin. Mesmerizing while also frightening.

    Legend

    When the textual description of a link is part of the link, it is the title of the page being linked to, when the text describing a link is not part of the link, it is a description written by Bart.

    Emoji Meaning
    🎧 A link to audio content, probably a podcast.
    ❗ A call to action.
    flag The story is particularly relevant to people living in a specific country, or, the organisation the story is about is affiliated with the government of a specific country.
    📊 A link to graphical content, probably a chart, graph, or diagram.
    🧯 A story that has been over-hyped in the media, or, “no need to light your hair on fire” 🙂
    💵 A link to an article behind a paywall.
    📌 A pinned story, i.e. one to keep an eye on that’s likely to develop into something significant in the future.
    🎩 A tip of the hat to thank a member of the community for bringing the story to our attention.
    🎦 A link to video content.

    Leave a Reply

    Your email address will not be published. Required fields are marked *

    Scroll to top