2

I just ran this command and saw that Safari was modified.

$ codesign --verify -vv /Applications/Safari.app/
--validated:/Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment
/Applications/Safari.app/: a sealed resource is missing or invalid
file modified: /Applications/Safari.app/Contents/Resources/English.lproj/InfoPlist.strings
file modified: /Applications/Safari.app/Contents/Resources/English.lproj/ServicesMenu.strings

My questions are:

  1. Is there any way to see what exactly was changed?
  2. Why Safari could have been modified? (I didn't do it and I don't suspect a virus to change translations)

I'm running Safari 7.0.5 on OS X 10.9.4

1

The way to determine what changed is to diff the current folder against a backup copy from when the code sign was valid.

Why could be as simple and harmless as bit rot or a filesystem error and it could be that some other tool injected code.

Unless you routinely list and checksum each file in /Applications/Safari.app and compare those results, your best bet might be to re-install the latest combo updater from http://apple.com/downloads and re-check that the binary is properly signed. If not, you might need to back up that machine and start with a clean erase and reinstall and watch to see what / when Safari gets modified going forward.

  • Injecting code in string files doesn't make much sense, does it? I restored Safari from Time Machine from the day right after the last software update, which included Safari 7.0.5 and it gives me the same warning. I'm now trying to reinstall the software update. – idmean Jul 24 '14 at 17:06
  • @wumm I agree the risk seems low - especially if those are the actual (and only) modified files in the bundle. – bmike Jul 24 '14 at 17:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .