19 ms·
New malware found on 30k Macs has security pros stumped
- nom 6y agoM1, 153 countries, AWS+Akamai as control infra? Yeah that has to be a tech demo.
- 13415 6y agoThey should rent this out as an installer service to Apple developers who are sick of Gatekeeper and complex app review requirements.
- 2cb 6y agoAren't the app review requirements only necessary to submit apps to the App Store? Pretty certain you can still distribute software through your own channels without Apple reviewing it, you just need to apply as developer with Apple so the app is signed, then Gatekeeper doesn't get in the way. Also I notice that Homebrew packages run just fine without needing to be signed by Apple, not sure how but that's a possibility if you really don't want to jump through Apple's hoops.
- mchristen 6y agoSigning doesn't keep Gatekeeper away, you need to also get your app notarized, which involves uploading the app to Apple's servers.
- 2cb 6y agoAh fair enough, didn't know they were so strict with software distributed outside the App Store. I say the best thing to do is distribute your software using Homebrew then. As well as it being super convenient since it's effectively the same as apt or any other package manager common to other Unix systems, it bypasses Gatekeeper. Got curious how and it's amazingly simple, it literally just provides an environment variable that deletes that "quarantine" xattr metadata.[1] Tell your users Homebrew is the supported installation method and you can skip right over Gatekeeper. [1] https://github.com/Homebrew/homebrew-cask/issues/85164 https://github.com/Homebrew/homebrew-cask/issues/85164
- stephenr 6y agoNotarizing is not strict by any definition of the term, unless you consider "scans your software for malicious content, checks for code-signing issues" to be strict? It's an automated system. Also, if you tell me your app is only installable via Home-brew, I'm not installing it. Comparing Homebrew to Apt, is like comparing a playdough and crayon sandwich, with an actual sandwich. Sure, they both look kind of similar at a distance, and technically you can eat both of them, but one is really not well thought out, and if you say you don't like how it tastes, the child who made it will get upset with you.
- 2cb 6y agoWhat is your specific beef with Homebrew? You insult it but don't provide any reason it's so much more inferior compared to apt. There are some ways Homebrew is actually more secure than apt. For example in order to do anything with apt you must give it superuser rights. The same is not true of Homebrew, which installs binaries in userspace and explicitly tells you to never use sudo. A Homebrew installer is a simple Ruby script you can easily audit for yourself. The packages are SHA256 signed to ensure code integrity. You can point it at a specific repo you trust and tell it to get a package from there. All downloads are done through a TLS connection, which is not the case for apt. And of course the whole thing is open source. I fail to see where the hate is coming from. > Notarizing is not strict by any definition of the term, unless you consider "scans your software for malicious content, checks for code-signing issues" to be strict? I mean, having to register as a developer, get a certificate to sign your apps, and still have to send off your software to Apple each time you update it before you can distribute it on your own website is pretty "strict" compared to every other OS. It doesn't seem to do much to prevent malware in the wild either.
- yjftsjthsd-h 6y agoI don't have a stake in this fight, but some of those don't really seem like advantages over apt - > The packages are SHA256 signed to ensure code integrity. And apt uses GPG signatures. > You can point it at a specific repo you trust and tell it to get a package from there. Exactly like apt? > All downloads are done through a TLS connection, which is not the case for apt. Since apt enforces GPG signatures by default, this could be a privacy issue but shouldn't be a security issue. Unless you meant only for the sudo/non-sudo to be your point on being better than apt and the rest was just defending homebrew?
- deleted 6y ago[deleted]
- shortandsweet 6y agoDoes hn shadow ban? I saw 1 comment count but none in the thread.
- minikites 6y agoYes, use the "showdead" toggle on your profile page.
- Spare_account 6y agoI have showdead enabled, there are no dead comments on this thread and the current comment count matches the number of visible comments. I suspect the GP comment's observation was due to a timing issue
- codetrotter 6y agoOr someone may have vouched for the comment in the meantime
- shortandsweet 6y agoHmn I dunno what it was to be honest. I checked multiple times and refreshed, at least I thought I did. Shrug. My app that I'm using has no settings to showdead so I wouldn't be surprised if the refresh didn't work as it doesn't from time to time. I really need a new app. Any recommendations?
- jtbayly 6y agoHave you tried a web browser? Safari is nice.
- dylan604 6y agoWhy does it need an app?
- shortandsweet 6y ago
- social_quotient 6y agoHow do they get or approximate an infection count?
- bognition 6y agoLooks like the researchers are running a sinkhole that the malware phones home to. From there it’s a matter of counting unique ips and dropping cookies.
- Sebb767 6y agoAt the end of the article: > “To me, the most notable [thing] is that it was found on almost 30K macOS endpoints... and these are only endpoints the MalwareBytes can see, so the number is likely way higher,” Patrick Wardle [...] wrote in an Internet message. So it seems MalwareBytes detected it on 30k customers' Macs.
- social_quotient 6y agoYeah so I kinda wonder what percent of macs use malwarebytes.
- fortran77 6y agoApple makes claims that they're "secure" but is that really true? Is their fundamental design really different from anyone else's? No word in this article about the infection vector.
- Sebb767 6y agoAs long as you can execute anything you want on your Mac, you can execute malicious code. Without the infection vector (which is probably not known yet), it is impossible to say whether it is user error or a security vulnerability.
- 13415 6y agoMost of Apple's security is theater and instead used to bind developers to their infrastructure and make it harder to use software outside their tightly controlled app stores. You used to be able to get the password of encrypted home directories from the page file with a simple grep command for many years without any attempts by Apple to fix it, that alone should tell you how secure Macs are.
- zepto 6y ago> You used to be able to get the password of encrypted home directories from the page file with a simple grep command You already have to be root to do this. This tells you nothing about Mac security.
- tiagod 6y agoIt's probably phoning home, although the article isn't clear on that, so perhaps the people controlling it are only using it in attacks targeting specific people or organisations.
- qzw 6y agoA pretty polished delivery mechanism, including native M1 binary, with no payload. Sounds like R&D in preparation for a real deployment, or possibly a demo for a package that will be sold to third parties.
- Sebb767 6y agoIt might also be a targeted attack. I can easily imagine a TLA using a wide net to get the target infected, but only delivering the payload to the intended target (which can be detected by IP, for example).
- 2cb 6y agoIf this is the work of a nation state attacker, as sophisticated attacks often are these days, this is a very likely possibility. We saw just recently the likely Russian backed attack on a wide net of US companies and even government agencies. I doubt Macs are used often in US gov agencies but they are used in tech companies for example. That latest attack hit a lot of seemingly random US companies but if you want to destabilise and cause loss of trust it is a very effective strategy. I happen to know someone who works high up in one of the affected companies where the malware had been sitting on the server for a few months passively gathering information before the attack. They struck in the middle of the night local time and erased all the backups before they begun running ransomware across the entire corporate network. Thankfully the attack was caught within 10 minutes and they were able to recover fairly quickly once the dust settled, but they've got especially good security. Such an attack could have done far more damage to a company. And if, like me, your first thought was "you're seriously saying they have good security but no off-site backups?" Yeah, I know. I'd bet they have regular off-site backups now though...
- leephillips 6y agoMacs on the desktop are quite common in the US government.
- 2cb 6y ago
- andor 6y agoThat's why I'm always hesitant executing .pkg installers. Luckily, the .app in most .pkg files can simply be extracted on the command line using xar.
- choeger 6y agoMaybe this is a stupid question, but what makes you trust the app when you mistrust the installer? Or mistrust the installer when you trust the app? Shouldn't both come from the same more or less trustworthy source?
- bilkow 6y agoThe installer needs root (admin) permission, which may be abused.
- pjmlp 6y agoHaving access to $HOME is already gone enough to produce irrecoverable damage, specially if there is Internet connection.
- blub 6y agoModern macOS doesn't give access to specific home subfolders to apps.
- pjmlp 6y agoWhich not everyone is using, this is only enabled since Catalina.
- 2cb 6y agoTo add to blub's response, macOS operates on a permissions system similar to iOS. A new application has to ask permission the first time it tries to access anything in your home folder. Moreover, it is also quite granular. You can allow access to "Downloads" but still have to grant permission for it to access "Documents" later.
- FDSGSG 6y ago> Also curious, the malware comes with a mechanism to completely remove itself, a capability that’s typically reserved for high-stealth operations. What? Even random hackforums bots have this feature.
- dapids 6y agoAnd competent malware author can add that to some level of sophistication, it's a no brainer. (Agreeing)
- bitwize 6y agoThe fact that it can remove itself sounds like it might be a PoC that made it out of some lab and into the wild. Kinda parallels some of the theories about COVID...
- Gys 6y ago> For those who want to check if they're Mac has been infected, Red Canary provides indicators of compromise at the end of its report. At the end of https://redcanary.com/blog/clipping-silver-sparrows-wings/ https://redcanary.com/blog/clipping-silver-sparrows-wings/
- 2cb 6y agoSounds like this was discovered by MalwareBytes so if you have that installed a scan should let you know too. Also, Little Snitch will show you the connections it makes every hour. Before anyone says it - in macOS 11.2, Apple removed the exclusion list that allowed their own software to bypass firewalls.[1] [1] https://blog.obdev.at/a-wall-without-a-hole/ https://blog.obdev.at/a-wall-without-a-hole/
- TacticalCoder 6y agoThe guys at redcanary.com are giving cryptographic hashes as... MD5. 2021. MD5. I can't wait to hear the apologists. EDIT: instead of downvoting it would be nice to explain why it's fine to use and encourage the usage of MD5 in 2021.
- jcrawfordor 6y agoI hate to be an apologist, but MD5 is the norm in IOCs for two reasons: 1) All of the tools expect and produce MD5 because it is the convention. Computing MD5 hashes of every file on disk or passing through a network is a relatively common forensic operation right now, SHA256 is not. 2) IOCs are not intended to be used in scenarios in which a malicious collision presents a problem (no one would want to... mask their malware to still look like malware?) so there is little downside to carrying on the convention. While I would recommend against MD5 in most modern applications, if nothing else to avoid having discussions like this all the time, before upsetting an entire ecosystem of tools it is important to consider whether or not the known weaknesses of MD5 actually pose a problem. In this case, a matching hash is the bad state, and so there is no real impact of a preimage attack.
- Sebb767 6y agoI didn't downvote you, but this use case of MD5 is fine - you want to verify whether the binary matches the one they have. You could spend a few hundred bucks on AWS to have a binary which matches that as well, but what would be the point - have users delete it? Now, if you used it to verify whether a binary was _secure_, this would be problem. But in this case, the (still unlikely) possibility of a false positive is not really a threat.
- Traubenfuchs 6y agoHold on: > Amazon Web Services and the Akamai content delivery network Why isn‘t AWS investigating?
- rini17 6y agoThey do forward abuse notices to whoever rents the infrastructure. Perhaps some kind of investigation happens if these are not acted upon.
- kortilla 6y agoLol, so Apple would notify Amazon of some kind of advanced malware, and Amazon’s first step would be to notify the malware authors?
- rini17 6y agoLOL, do you think whoever is managing the malware has themselves paid AWS to host it? This kind of affair usually gets escalated to CEO level. Bezos will pick up the phone if Cook calls. But usual plebs business goes via abuse notices as I described.
- Traubenfuchs 6y agoI did indeed think so and did not consider that the AWS servers are controlled via hacks/malware themselves! It just sounded like the malware authors just rent AWS with their own credit cards...
- jimrandomh 6y agoGenerally speaking, malware authors build their command and control networks out of compromised computers owned by third parties. After all, they're already in the business of compromising computers, and using their own computers would leave an unnecessary trail back to them.
- Sephr 6y agoPerhaps they are bound by a National Security Letter.
- awinter-py 6y agoyeah but it also has the biologically useful ability to efficiently synthesize ATP so we may incorporate it into our germline rather than uninstalling it
- TacticalCoder 6y ago> ~/Library/._insu (empty file used to signal the malware to delete itself) The article apparently doesn't explain how to protect against the malware? Cannot hurt to manually create ~/Library/._insu right? (not that it seems to offer great protection but I take it cannot hurt?) Anyone got any idea as to how to harden OS X a bit against this malware?
- 2cb 6y agoWe don't actually know what attack vector it's using so it's pretty much impossible to say at this point. It could be a simple trojan or it could be an advanced 0day chain. We have no clue. There'd be no point manually creating the file, by the time the malware sees it, you are already infected. My advice: keep your OS and browser and everything else updated, use uBlock Origin in the browser, and use a network-wide ad blocker (Pi Hole, AdGuard Home - personally I prefer the latter) with a few malware blocklists and keep them updated. Malwarebytes were the ones who discovered how big this thing is so you can install that on your Mac and run scans. You may also want to invest in Little Snitch which won't necessarily protect you against an infection but it will alert you to the calls the malware keeps making to its C&C servers. It's also entirely possible the self-destruct mechanism they found is triggered by such software being installed on the machine. Past Mac malware often removes itself if it detects Little Snitch. And, obviously, don't install random software from shady sources, but I assume anyone on HN knows this already.
- pfortuny 6y agoSee PROTIP above by lapcatsoftware (several threads above)
- forgotmypw17 6y agoOne more: browse the web without JS, except on trusted sites, and tell everyone else to sod off. Bonus: Avoid a lot of low-quality content.
- Geee 6y agoIt's probably North Korea trying to extract some Bitcoin. All their computer science resources are now focused on this 24/7. So be careful.
- ok123456 6y agoIt's probably the CIA/Israel trying to do another Stuxnet. All their computer science resources are now focused on this 24/7. So be careful.
- deleted 6y ago[deleted]
- williesleg 6y agoPayload is 'help I'm being held captive in a mac manufacturing plant against my will'
- mensetmanusman 6y agoNews like this reminds me why it will take a lot to adopt crypto currencies. For all we know, this software could just be quietly collecting wallet passwords waiting for an opportune moment to attack. With the sophistication of red team hackers from Russia, China, NK, and Iran, why would we want to computers for such critical infrastructure as payment?
- brundolf 6y agoI'm no crypto apologist, but dollars are hardly less digital than bitcoins at this point
- MR4D 6y agoYou make a good point, but I can still use dollars in offline mode - i.e. the paper in my pocket - even when I am nowhere near a computer or communication device. That feature still makes them desirable...especially in places like frozen Texas this past week.
- MR4D 6y agoFor whomever downvoted this comment, you should have been there in 29 degree weather when I was buying 6 gallons of bottled water with cash. There was no cell service and the place could only take cash. It was a 30 minute wait in the cold, but I used the water both for drinking, and so I could flush my toilets (city water was not working). So if you disagree, fine - in fact share your opinion - I’ll probably learn something. But by downvoting it showed ignorance.
- cyberpunk 6y agoWhy am I missing? That’s only like -2C which practically t-shirt weather isn’t it?
- IAmGraydon 6y agoI’m guessing that’s a Texan.
- theamk 6y agoTangentially related to this post: I am surprised at the infosec’s love of file checksums, like MD5 here. There are endpoint tools which collect MD5’s, network scanners which collect MD5s, and I have heard about actual infosec directors who, upon seeing a blog post like that, would carefully type the hashes in their endpoint management interface to make sure their org is not infected. How on earth can this be effective? It is trivial to create customized binaries in the installer, so no two users have the same file checksum. With a bit of work, one can rig their download server so each user has a completely different installer checksum as well. I remember reading about polymorphic viruses back in the 1990’s - not only those had different checksums for each computer, they also had no long-ish substrings common between two versions, making signature analysis ineffective. Did malware authors just forgot about all those and went back to trivial “everyone gets the same image” strategy?
- Aerroon 6y agoWhat they really need is a whitelist of checksums instead. Preferably not md5 though.
- noinsight 6y agoThat is what Windows Defender Application Control does. It's probably the most cutting edge solution on the market actually. It's a pure whitelisting solution where every single executable and kernel driver needs to have an approved digital signature or matching hash value or they won't be permitted to run. It's virtualization assisted and can't be disabled without rebooting and if you use a digitally signed policy and someone tries to remove it, the machine will refuse to boot. The coolest thing is, it even expands to the scripting languages built-in to Windows so PowerShell execution is restricted according to policy etc. In practice of course, it's a big pain in the ass to manage - many software are not digitally signed etc. Every single artifact of every program needs to be digitally signed or have a matching hash in the policy or they won't be permitted to run. For example, suppose a software installer: the .msi itself is digitally signed so can easily be permitted to run... But then, during installation it unpacks an .exe into %temp% that isn't digitally signed and attempts to run that - oops, won't run. I've come across even Microsoft software that does this. https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control https://docs.microsoft.com/en-us/windows/security/threat-pro...
- soheil 6y agoSo without having to install yet another app on my mac which could be riddled with malwares itself disguised in the form of an anti-virus program and typically notorious for thrashing the machine, what's the best way to find out if my machine is infected?
- mceachen 6y agoLook at the files in the "Detection opportunities" section at the bottom of the article: https://redcanary.com/blog/clipping-silver-sparrows-wings/ https://redcanary.com/blog/clipping-silver-sparrows-wings/
- soheil 6y agoI see people mentioning ~/Library/LaunchAgents to look for suspicious apps. I should mention there are at least 4 other places where a launch agent could start on OSX: ~/Library/LaunchDaemons ~/Library/LaunchAgents /Library/LaunchDaemons /Library/LaunchAgents Not to mention Login Items under System Settings. Finally, I hope it's obvious if you're infected for all you know all your legitimate looking launch agents could be infected and secretly run the malware in a background process upon execution.
- SheinhardtWigCo 6y agoThis app will alert you when launch agents and other persistence items are added: https://objective-see.com/products/blockblock.html https://objective-see.com/products/blockblock.html
- saagarjha 6y ago> ~/Library/LaunchDaemons Launch daemons are installed for the system only. Normal users can only run agents.
- afrcnc 6y agoActual source, not this wattered-down Ars rewrite: https://redcanary.com/blog/clipping-silver-sparrows-wings/ https://redcanary.com/blog/clipping-silver-sparrows-wings/