Apple's macOS Catalina: LibreOffice users still get 'scary' malware messages
Users of open-source office productivity software LibreOffice report running into overly alarming security warnings when installing the app on the recently released macOS 10.15 Catalina.
Apple
Apple warned macOS developers in June that all Mac apps that are signed with a Developer ID would also need to be 'notarized' by Apple. Apple promised this would enable a "more streamlined Gatekeeper interface" when users download macOS apps from the web.
Apple's notary service scans apps for malware for developers who distribute apps outside Apple's App Store. The notarization can prevent cases where an attacker has compromised another developer's Developer ID signing certificate to sign and distribute macOS malware.
SEE: 20 quick tips to make Linux networking easier (free PDF)
During the public beta for macOS Catalina some LibreOffice users noticed that Apple's GateKeeper warnings had the potential to scare users off. "'LibreOfficeDec.app' can't be opened because its integrity cannot be verified," the alert reads, with two options: Move to Bin or Cancel.
While LibreOffice version 6.2 was not notarized, the latest 6.3 version apparently has been. However, users are still getting the GateKeeper alert with the additional warning that "macOS cannot verify that is app is free from malware", according to LibreOffice.
"Although we have duly followed the instructions, when users launch LibreOffice 6.3.x – which has been notarized by Apple – the system shows the following scary message: 'LibreOffice.app cannot be opened because the developer cannot be verified', and provides only two options: Move to Bin (delete) and Cancel (revert the operation, ie, do not run LibreOffice)," writes LibreOffice's Italo Vignoli.
To bypass the message, LibreOffice recommends user right-click the mouse on the LibreOffice icon. Then macOS Catalina will show a less alarming message: "macOS cannot verify the developer of LibreOffice.app. Are you sure you want to open it?".
The other way to resolve the issue is to click Cancel on the first alert, and then open System Preferences > Security & Privacy and then click on the Open Anyway button next to the message that the "App was blocked because it is not from an identified developer".
In 2018 the Document Foundation, the non-profit behind the free office suite, estimated there were 200 million active LibreOffice users worldwide.
As for Apple's notarization, app developer Jeff Johnson recently explained that the key security benefit comes from the requirement that developers use their Apple ID and password for their developer account to submit the app to Apple for notarization.
In other words, an attacker would need to compromise both a signing certificate and the developer's Apple ID to distribute the malware. The extra security here comes from Apple's recent requirement that all developer accounts have two-factor authentication enabled.
Some LibreOffice users think the macOS message could put some people off using the open-source office suite.