ole/NSBundle-OBCodeSigningInfo — Issue #1: not secure
Author: valexa
Created: 2012-02-28 04:35:26+00:00
State: open

If you just copy /Contents/_MASReceipt to from a MAS app to another one with the code below it thinks both the sig is valid and that it is from the MAS

if ([[NSBundle mainBundle] ob_comesFromAppStore] == YES) {
NSLog(@"from app store");
}else {
NSLog(@"not from app store");
}

if ([[NSBundle mainBundle] ob_codeSignState] == OBCodeSignStateSignatureValid) {
NSLog(@"sig valid");
}else {
NSLog(@"sig invalid");
}

2012-02-28 06:29:48.702 SandBox[1019:60b] from app store
2012-02-28 06:29:48.858 SandBox[1019:60b] sig valid

Additionally binaries signed with a self signed certificate also work and arguably it would be more helpful if it checked that it has a Apple Root CA