14 ms·
Mysterious Mac Malware Has Infected Victims for Years
- tyingq 9y ago"It was also written in Perl, a language that's "archaic" for malware" Perhaps why it's good at running under the radar.
- wil421 9y agoSounds like a disgruntled sys admin.
- deckar01 9y agoI think the main reason it was running under the radar is that the script itself did not contain an exploit that bypassed any security mechanisms. The only difference between a remote desktop app and a new command and control malware is the way it is installed. It is not all that surprising to me that any targeted malware could operate unnoticed for years. The odds of discovery are directly proportional to the volume of distribution and inversely proportional to the importance of the targets. This malware apparently infected a small number of low profile targets.
- matheweis 9y agoIt's not just perl; the screen capture code apparently references GWorlds, something I frankly have not seen since writing software in the 1990's for pre OS X APIs. It's so old that Googling for gworld hardly has any relevant results. Most of the sample code for those APIs was deprecated by the mid 2000's Unless the attacker had some unique reason for using that, which seems unlikely, that really does put the code at about 10 years old or so...
- reaperducer 9y agoGonna need it from a source better than Vice.
- brian_herman 9y agohttps://www.forbes.com/sites/thomasbrewster/2017/07/24/apple-mac-malware-fruitfly-infects-americans/#410c5efb5ce5 https://www.forbes.com/sites/thomasbrewster/2017/07/24/apple...
- rconti 9y agoThe Vice article seems much better, and I'm not sure Forbes is a more reliable news source, but the corroboration is of course great. Sounds like we'll be hearing more after BlackHat. Wish I wasn't skipping this year.
- brian_herman 9y agoYeah the only other news sources I could find were zdnet and cnet.
- wil421 9y agoI'd imagine they are all reporting from a common source or they read Vice.
- Grazester 9y agoForbes, the site that served malware in their ads(you can't view their page with an adblocker on either).
- wernercd 9y agoObligatory: https://www.extremetech.com/internet/220696-forbes-forces-readers-to-turn-off-ad-blockers-promptly-serves-malware https://www.extremetech.com/internet/220696-forbes-forces-re...
- danso 9y agoThe OP's author, Lorenzo Franceschi-Bicchierai, has always felt like a reliable reporter of this kind of topic, as far as mainstream reporters go: https://motherboard.vice.com/en_us/contributor/lorenzo-franceschi-bicchierai https://motherboard.vice.com/en_us/contributor/lorenzo-franc...
- abakker 9y agoIs this the same thing? https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/ https://blog.malwarebytes.com/threat-analysis/2017/01/new-ma... It looks like this has been updated by Apple already?
- SingletonIface 9y ago> Taking control of a command and control server, however, had another unexpected outcome: Around 400 victims infected with FruitFly started connecting to it. "Unexpected"? How? This would have been obvious to Wardle. Maybe the journalist added this to "inject some suspense"? Thanks but no thanks, I won't bother reading the rest of this article.
- shepard 9y agoDoes anyone know of a good way to check whether my Mac is infected with this (or any other) malware programs? I rarely, if ever, download unknown programs, and my OS is always up-to-date, but still... Would appreciate for any pointers.
- guessmyname 9y agoInstall MalwareBytes — https://www.malwarebytes.com/ https://www.malwarebytes.com/
- scrumper 9y agoIs this bad advice? Wondering why it's getting voted down. Malwarebytes discovered the issue after all; they're not disreputable.
- JadeNB 9y agoIf abakker's comment https://news.ycombinator.com/item?id=14840063 https://news.ycombinator.com/item?id=14840063 is the same issue, then it sounds like you just need to look for `~/.client` and `~/Library/LaunchAgents/com.client.client.plist`.
- unpythonic 9y agoThe details for the infection can be found at Malwarebytes, the discoverer of this issue: https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/ https://blog.malwarebytes.com/threat-analysis/2017/01/new-ma... This article has the signature of the infection as well as listing the servers with which it communicates.
- intoverflow2 9y agoSomeone correct me if I'm wrong but this seems to be talking about FruitFly 1 [1] and the article is about FruitFly 2 [2]. Been digging around and still can't find any description of how to tell if you're infected by the new one. [1] https://www.virustotal.com/en/file/ce07d208a2d89b4e0134f5282d9df580960d5c81412965a6d1a0786b27e7f044/analysis/ https://www.virustotal.com/en/file/ce07d208a2d89b4e0134f5282... [2] https://www.virustotal.com/en/file/befa9bfe488244c64db096522b4fad73fc01ea8c4cd0323f1cbdee81ba008271/analysis/ https://www.virustotal.com/en/file/befa9bfe488244c64db096522...
- epistasis 9y ago>the widespread belief that they are virus-free, Macs aren't immune from invasive and dangerous malware. This is an area where it's really hard to extrapolate from my personal experience to the entire population, but is this really an accurate statement of many people's beliefs? I think what people actually think is that the chances are much lower of encountering malware in the wild on a Mac. In support of that, having an article this long on a single piece of malware that isn't particularly damaging, would indicate that it's not the normal state of affairs in Mac land. I would similarly expect that the chances of drive-by malware on Linux are tiny, perhaps even less common than on a Mac, and thus it would be newsworthy if there were some widespread (in relative terms) Gnome malware, or similar. It's one thing to think that it's uncommon, and another to think that it's impossible.
- digi_owl 9y agoI think it is a holdover from the early Mac days, where a large part of the base OS was in ROM. Thus a simple reboot would clear out any infection. That, and over time the lack of a general market presence, is likely what lead to the belief (never mind that Apple pushed the message with their I'm a Mac ads).
- 80211 9y agoThe early mac days when there was no hard-disk, maybe. But if you inserted another floppy when the virus was in-memory, it would spread!
- tedunangst 9y agoIt's been a few years, but the "I'm a Mac and I'm a PC" ad series talked up virus immunity quite a bit. I suppose one could argue that "don't get malware" was narrowly accurate in the sense that it wasn't presently happening, but there was a strong suggestion of "can't get malware" too.
- coldtea 9y agoIt was presently, and it's easy much happening now either. All these "viruses", or 99% of them, are just trojans.
- mediocrejoker 9y agoAs someone new to the Mac ecosystem, is it standard practice to run an antivirus as it is on Windows? I have used various Linux systems as my daily web browsing machine for years without feeling the need to install any third-party antivirus.
- coldtea 9y ago>As someone new to the Mac ecosystem, is it standard practice to run an antivirus as it is on Windows? No, almost nobody does it (plus, a few "antivirus" products for Mac are malware themselves, e.g. Mac Defender etc.). Most so-called "viruses" for Mac are in fact merely trojans (programs you need to download and run yourself to infect you).
- redler 9y agoNo. It's unusual. The most common case is Macs in corporate environments where "local anti-virus" is required across all desktop systems (with such policies typically originating in Windows-centric companies).
- adrianN 9y agoYou probably shouldn't install any antivirus on Windows either. They're so full of holes that they probably increase the likelyhood that you get a virus.
- pwython 9y agoI was a Windows user for 10 years. Now a Mac user for 11 years. Haven't needed any sort of antivirus yet. Just thinking back to my time with Windows makes me chuckle, when I had an arsenal of virus scanners, startup disablers, and registry cleaners on hand.
- jmull 9y ago> ...despite the widespread belief that they are virus-free, Macs aren't immune from invasive and dangerous malware. I keep hearing this, but I never see evidence of these people. Is there a widespread belief that there's a widespread belief that Macs are immune from malware, despite few people who actually think this? Well, I'm sure such people exist, but there don't seem to be many, even on sites like macrumors and /r/apple where mostly non-technical people with magical feelings for Apple gather and comment.
- kuschku 9y agoApple literally had that in their ads.
- cmurf 9y agoThey still do. https://www.youtube.com/watch?v=dRM31VRNQw0 https://www.youtube.com/watch?v=dRM31VRNQw0
- jmull 9y agoThat's iOS vs. Windows and we were taking about macOS. I think that marketing language is a bit BS-y, though. Probably the general idea they are pushing, that iOS is less susceptible to malware than a laptop, is probably true, so it doesn't bother me much.
- jmull 9y agoYes, but a decade or more ago. The security landscape and perceptions around it have changed. Also, back then the difference between MacOS and Windows was pretty stark so this was a valid marketing point. Not that the ads didn't oversell it, of course.
- 80211 9y agoWrong. They still do: https://www.apple.com/business/products-platform/ https://www.apple.com/business/products-platform/
- kylehotchkiss 9y agoGiven that most people here would be best off not-hacked, what are the best ways (software/security tricks) to avoid malware on OSX?
- philfrasty 9y agoBlockBlock is genius for preventing installation of persistent components to the OS. [1] https://objective-see.com/products/blockblock.html https://objective-see.com/products/blockblock.html
- kccqzy 9y agoI like the concept but I don't like the fact that BlockBlock needs to install a kernel extension. It says it does this to minter process creation. Why can't it do it with dtrace? Example: https://github.com/kenorb/dtrace-tools#processes https://github.com/kenorb/dtrace-tools#processes
- redm 9y agoLinux has a huge advantage in that it has a very wide array of variants, kernels, library configurations through many standard distros and further customizations. It makes it much harder to write distribute complex malware than a standardized OS like Windows.
- snarfy 9y agoThey were surprised to find malware that wasn't written by a nation-state, which is kind of depressing.
- sitkack 9y agoI see no reason to believe it wasn't. Being brutally pedestrian is the kind of thing I would expect out of great hackers.
- divanvisagie 9y agoAlso , it may make sense to write malware that looks like it wasn't a nation state if you are a nation state
- ecommerceguy 9y agoSo, let me get this straight. If I develope malware in an "archaic" language, using "crude code" then I am not a nation-state. "Undetected for years" Interesting logic. I wonder if the reverse can be said... If I were a nation state, perhaps I would be taking notes.
- joejoebob 9y ago> the former spy agency hacker who now develops free security tools Nice try, NSA.
- gaius 9y agoMissing from the article: how to tell if you have it and what to do if you do
- divanvisagie 9y agoYeah, I just stuck tape over my camera though.
- stereo 9y agoSee if you have a ~/.client or a ~/Library/LaunchAgents/com.client.client.plist file.
- gaius 9y agoThanks for the tip - I'm clean :-)