6 ms·

Newly discovered Mac malware uses “fileless” technique to remain stealthy

zeristor 7y ago
The curious thing here is I noticed this in my News app on my iPhone, I went to read more, but I had a message saying the story had been removed. Yet here it is; still on Ars Technica. Am I to infer that Apple censured this story in their News App? Its not appearing as a story in the Ars Technica channel, even thought it was recently posted. Does this then suggest that this is a hot issue for Apple?
- Wowfunhappy 7y ago
  > Am I to infer that Apple censured this story in their News App? I mean, I guess that's possible, but it seems much more likely that this is just a bug. The Apple News app can be weird sometimes.
- 52-6F-62 7y ago
  AFAIU Apple doesn't touch much of the individual channels. They editorialize the main feeds by hand. If it's gone from Ars' channel then Ars must have removed the article from Apple News for whatever reason, possibly even by mistake.
- penagwin 7y ago
  I've noticed this with other stories, it feels more like we clicked the link when it wasn't updated to the latest news, somehow taking us to a stale page. It doesn't feel like censorship from what I've experienced, more like a link going stale or something - theres not really any common themes in the articles ice noticed.
- machello13 7y ago
  Much more critical stories of Apple than this one have been published on the News app. It's 100% a bug. Can you imagine the PR disaster if it turned out Apple was actively censoring negative stories about itself?
  - zeristor 7y ago
    A bug? So how many stories don't get through. Is it that tricky to get a feed of stories and match them up with items appearing in the newsfeed? If its not going through you go back and check to see where the story is lost. I've done this on websites I was supporting, finding that people copying and pasting from PDF seem to have picked up a number of unicode control characters that hadn't been rinsed out when stored in SQL, and caused the web API to splutter. This was for item records clients were paying for so dropping records looks a bit naff. Enough of me though, dare I say it News has just one job, to show news.
chadlavi 7y ago
TLDR: this probably doesn't affect you if you're not on crypto exchanges. Check if you're affected: ls /Library/LaunchDaemons/vip.unioncrypto.plist ls /Library/UnionCrypto/unioncryptoupdater
- 3JPLW 7y ago
  So, there are files?
  - chadlavi 7y ago
    Yeah it seems like there are. I guess to a layman user there don't appear to be, because they're in hidden directories? But also how many layman users are going to crypto exchanges on a mac?
  - seanhunter 7y ago
    Yes. It is not in any sense fileless.
tehwebguy 7y ago
> Newly discovered Mac malware uses “fileless” technique to remain stealthy ... > The malware isn’t entirely fileless. The first stage poses as a cryptocurrency app with the file name UnionCryptoTrader.dmg Come on...
- pvg 7y ago
  It's explained in the article and in more detail in the longer analysis it links https://objective-see.com/blog/blog_0x51.html https://objective-see.com/blog/blog_0x51.html The 'fileless' part is about getting the executable payload that does the actual malwarin' into memory without touching the filesystem.
  - CodeWriter23 7y ago
    Except for the part about moving a launch script into /Library/LaunchDaemons to achieve persistence.
    - pvg 7y ago
      That's the scaffolding, basically. A launch script in itself is not malicious and the idea is this would be less noticeable to automated or manual scans.
      - moralestapia 7y ago
        >An executable file in itself is not malicious
        pvg 7y ago
        I'm not sure who you're quoting but it's not me. Easiest way to get a more detailed explanation is to read the linked technical analysis. The idea is to obfuscate and make detection harder by not-placing the actual final payload on the filesystem. Staging more-malicious things through things that look less-malicious is pretty much what makes malware mal.
deminature 7y ago
Yet another virus for OSX that you have to manually download a DMG and install to be vulnerable to. Not to be obnoxious, but I'm still waiting for a Windows-style virus that can proliferate with no action on the user's behalf. That would be legitimate cause for concern.
- j0hnml 7y ago
  Malware that can proliferate on Windows boxes without user action almost always requires some remote code execution vulnerability (or some security misconfiguration issue) to be exploited first. This is true for macOS as well. That cycle is usually: Exploit vuln -> download malware payload -> execute malware
  - zbentley 7y ago
    I think that was GP's point as well. That fully hands-free RCE process just doesn't seem to happen as often on OSX as on windows. Whether that's because of market share, software differences, or something else remains open for debate.
rkagerer 7y ago
Not exactly fileless. There's a persistent component that remains on-disk (disguised as a cryptocurrency app), and when the OS launches it after boot it contacts a server to download the malicious, in-memory payload.

The curious thing here is I noticed this in my News app on my iPhone, I went to read more, but I had a message saying the story had been removed. Yet here it is; still on Ars Technica. Am I to infer that Apple censured this story in their News App? Its not appearing as a story in the Ars Technica channel, even thought it was recently posted. Does this then suggest that this is a hot issue for Apple?

Wowfunhappy 7y ago
> Am I to infer that Apple censured this story in their News App? I mean, I guess that's possible, but it seems much more likely that this is just a bug. The Apple News app can be weird sometimes.
52-6F-62 7y ago
AFAIU Apple doesn't touch much of the individual channels. They editorialize the main feeds by hand. If it's gone from Ars' channel then Ars must have removed the article from Apple News for whatever reason, possibly even by mistake.
penagwin 7y ago
I've noticed this with other stories, it feels more like we clicked the link when it wasn't updated to the latest news, somehow taking us to a stale page. It doesn't feel like censorship from what I've experienced, more like a link going stale or something - theres not really any common themes in the articles ice noticed.
machello13 7y ago
Much more critical stories of Apple than this one have been published on the News app. It's 100% a bug. Can you imagine the PR disaster if it turned out Apple was actively censoring negative stories about itself?
- zeristor 7y ago
  A bug? So how many stories don't get through. Is it that tricky to get a feed of stories and match them up with items appearing in the newsfeed? If its not going through you go back and check to see where the story is lost. I've done this on websites I was supporting, finding that people copying and pasting from PDF seem to have picked up a number of unicode control characters that hadn't been rinsed out when stored in SQL, and caused the web API to splutter. This was for item records clients were paying for so dropping records looks a bit naff. Enough of me though, dare I say it News has just one job, to show news.

chadlavi 7y ago

TLDR: this probably doesn't affect you if you're not on crypto exchanges. Check if you're affected: ls /Library/LaunchDaemons/vip.unioncrypto.plist ls /Library/UnionCrypto/unioncryptoupdater

3JPLW 7y ago
So, there are files?
- chadlavi 7y ago
  Yeah it seems like there are. I guess to a layman user there don't appear to be, because they're in hidden directories? But also how many layman users are going to crypto exchanges on a mac?
- seanhunter 7y ago
  Yes. It is not in any sense fileless.

tehwebguy 7y ago

> Newly discovered Mac malware uses “fileless” technique to remain stealthy ... > The malware isn’t entirely fileless. The first stage poses as a cryptocurrency app with the file name UnionCryptoTrader.dmg Come on...

pvg 7y ago
It's explained in the article and in more detail in the longer analysis it links https://objective-see.com/blog/blog_0x51.html https://objective-see.com/blog/blog_0x51.html The 'fileless' part is about getting the executable payload that does the actual malwarin' into memory without touching the filesystem.
- CodeWriter23 7y ago
  Except for the part about moving a launch script into /Library/LaunchDaemons to achieve persistence.
  - pvg 7y ago
    That's the scaffolding, basically. A launch script in itself is not malicious and the idea is this would be less noticeable to automated or manual scans.
    - moralestapia 7y ago
      >An executable file in itself is not malicious
      - pvg 7y ago
        I'm not sure who you're quoting but it's not me. Easiest way to get a more detailed explanation is to read the linked technical analysis. The idea is to obfuscate and make detection harder by not-placing the actual final payload on the filesystem. Staging more-malicious things through things that look less-malicious is pretty much what makes malware mal.

deminature 7y ago

Yet another virus for OSX that you have to manually download a DMG and install to be vulnerable to. Not to be obnoxious, but I'm still waiting for a Windows-style virus that can proliferate with no action on the user's behalf. That would be legitimate cause for concern.

j0hnml 7y ago
Malware that can proliferate on Windows boxes without user action almost always requires some remote code execution vulnerability (or some security misconfiguration issue) to be exploited first. This is true for macOS as well. That cycle is usually: Exploit vuln -> download malware payload -> execute malware
- zbentley 7y ago
  I think that was GP's point as well. That fully hands-free RCE process just doesn't seem to happen as often on OSX as on windows. Whether that's because of market share, software differences, or something else remains open for debate.

rkagerer 7y ago

Not exactly fileless. There's a persistent component that remains on-disk (disguised as a cryptocurrency app), and when the OS launches it after boot it contacts a server to download the malicious, in-memory payload.