Dan Goodin, writing for Ars Technica:
Camtasia, uTorrent, and a large number of other Mac apps are susceptible to man-in-the-middle attacks that install malicious code, thanks to a vulnerability in Sparkle, the third-party software framework the apps use to receive updates.
The vulnerability is the result of apps that use a vulnerable version of Sparkle along with an unencrypted HTTP channel to receive data from update servers. It involves the way Sparkle interacts with functions built into the WebKit rendering engine to allow JavaScript execution. As a result, attackers with the ability to manipulate the traffic passing between the end user and the server—say, an adversary on the same Wi-Fi network—can inject malicious code into the communication. A security engineer who goes by the name Radek said that the attack is viable on both the current El Capitan Mac platform and its predecessor Yosemite.
Note that Camtasia is in the official Mac App Store. This isn’t simply a problem confined to apps sold in the wild. I struggle to wrap my head around the specifics, but the articles I’ve read give the sense that this is an issue with using HTTP, that the problem would be solved if HTTPS was required.
As to Sparkle, it sounds like they’ve fixed the problem on their end, but developers need to rebuild, resubmit their apps to get that fix in the App Store. And there doesn’t appear to be an easy way to tell if the apps on your machine are vulnerable. Hopefully, Apple will address this quickly.
All the more reason why 90% of websites should be using HTTPS
Here’s how to find if any apps on your system are affected:
http://www.mackungfu.org/how-to-find-if-your-apps-are-affected-by-the-sparkle-hijack
Sparkle in a Mac App Store app just seems like a huge mistake.
I don’t think it’s true that application in the App Store are vulnerable. While the same app might be available in and out of the App Store, only the non-App Store version can be updated via Sparkle (see, for example, http://bruji.com/blog/2011/02/09/conditionally-building-a-mac-app-store-applications-to-exclude-sparkle/).
According to a Stack Overflow comment (http://stackoverflow.com/questions/17021972/sparkle-framework-and-the-mac-app-store-best-practices), an app that includes Sparkle will be rejected.
But if an App Store app somehow did include Sparkle, and tried to update itself, it wouldn’t launch because the signature check would fail.
This article is, rarely for The Loop, incorrect.
App store apps are not vulnerable to this. Camtasia is in the app store but it’s also available direct and that is the version which updates via Sparkle, as most auto-updating apps do.
You can’t use Sparkle on an app-store app, the app is signed before distribution, by Apple, and the upgrade would break it, apart from that you don’t need to because the App store has an update mechanism and you can’t do it because it’s checked for as part of the submission and rejected.
So there’s zero for Apple to address here, App store apps don’t need to be rebuilt or re-submitted and updates via the App store are not insecure.