Was the malware version also signed with an official Apple Developer ID? The same ID? Is a change of ID verified with the auto-updater?
If there was a malicious Developer ID, has it been revoked by Apple?
Anyone with a credit card can sign up for Apple's developer program and start signing apps.
[1] http://www.welivesecurity.com/2016/08/30/osxkeydnap-spreads-...
That's the terrible part about all of this. Having signed applications without any verification of the signer is pointless.
A simplistic, yet more secure approach, would be to have domain validated keys that could be used to sign applications. Browsers could then verify that the application downloaded from example.com was signed with a key for example.com. I think OSX already stores "This was downloaded from the scary internets!" in a separate resource fork so this info could go there as well. Maybe even cut out the middle mad and put them in DNS SRV records so you don't even need a central CA. If DNS gets compromised the client's have bigger problems already.
Unfortunately like all things like this, it'd be forever before it's widespread enough to be useful.
>> If your membership expires, users can still download, install, and run your Developer ID–signed applications. However, once your Developer ID certificate expires, you must be an Apple Developer Program member to get new Developer ID certificates to sign updates and new applications.
What I understand is that codesigning costs $99 a year, which open-source projects may want to skip, but this harms their credibility if their downloads are compromised.
https://developer.apple.com/support/compare-memberships/
What's not clear to me, however, is if the educational option allows for free developer-level memberships.
It looks like Educational memberships are Sign-In With Apple ID only, which doesn't provide a Developer ID (which is required for code signing, as far as I can tell).