6 ms·

> For those who want to check if they're Mac has been infected, Red Canary provides indicators of compromise at the end of its report. At the end of https://re

by Gys 6y ago

> For those who want to check if they're Mac has been infected, Red Canary provides indicators of compromise at the end of its report. At the end of https://redcanary.com/blog/clipping-silver-sparrows-wings/ https://redcanary.com/blog/clipping-silver-sparrows-wings/

2cb 6y ago
Sounds like this was discovered by MalwareBytes so if you have that installed a scan should let you know too. Also, Little Snitch will show you the connections it makes every hour. Before anyone says it - in macOS 11.2, Apple removed the exclusion list that allowed their own software to bypass firewalls.[1] [1] https://blog.obdev.at/a-wall-without-a-hole/ https://blog.obdev.at/a-wall-without-a-hole/
TacticalCoder 6y ago
The guys at redcanary.com are giving cryptographic hashes as... MD5. 2021. MD5. I can't wait to hear the apologists. EDIT: instead of downvoting it would be nice to explain why it's fine to use and encourage the usage of MD5 in 2021.
- jcrawfordor 6y ago
  I hate to be an apologist, but MD5 is the norm in IOCs for two reasons: 1) All of the tools expect and produce MD5 because it is the convention. Computing MD5 hashes of every file on disk or passing through a network is a relatively common forensic operation right now, SHA256 is not. 2) IOCs are not intended to be used in scenarios in which a malicious collision presents a problem (no one would want to... mask their malware to still look like malware?) so there is little downside to carrying on the convention. While I would recommend against MD5 in most modern applications, if nothing else to avoid having discussions like this all the time, before upsetting an entire ecosystem of tools it is important to consider whether or not the known weaknesses of MD5 actually pose a problem. In this case, a matching hash is the bad state, and so there is no real impact of a preimage attack.
- Sebb767 6y ago
  I didn't downvote you, but this use case of MD5 is fine - you want to verify whether the binary matches the one they have. You could spend a few hundred bucks on AWS to have a binary which matches that as well, but what would be the point - have users delete it? Now, if you used it to verify whether a binary was _secure_, this would be problem. But in this case, the (still unlikely) possibility of a false positive is not really a threat.
  - gruez 6y ago
    >Now, if you used it to verify whether a binary was _secure_, this would be problem Even that's probably fine. Collision attacks require the attacker to control both inputs. In the case of code signing this would mean the publisher is in on it, in which case you're already screwed.
    - Sebb767 6y ago
      > Collision attacks require the attacker to control both inputs. Technically, no. It gets a lot easier when you only need to find any pair of inputs which produce a collision, but with computing power increasing a lot and md5 being very broken, it is feasible that a determined attacker with a lot of compute power can create a collision with a fixed hash, or at least will be able to in the somewhat near future. I'd agree that you're reasonably secure, but when you need security, you shouldn't bother with outdated tech when secure and future-proof alternatives are readily available.
      - gruez 6y ago
        >it is feasible that a determined attacker with a lot of compute power can create a collision with a fixed hash That's a preimage attack, which is a much higher bar. Even for md5 there hasn't been much progress made: https://en.wikipedia.org/wiki/MD5#Preimage_vulnerability https://en.wikipedia.org/wiki/MD5#Preimage_vulnerability
        Sebb767 6y ago
        The referenced paper is from 2009 and points out a complexity of 2^123 (or roughly 10^27). Bitcoin miners currently put out ~150 EH/s, so about 10^17. Only judged by the rounds, double-sha256 (Bitcoin) has 128 and md5 has 4, so let's assume they'd do 10^18 hashes per second on md5. So it would take them about 31 years to find a collision. If the NSA found a way to get the complexity down a bit more (they had a decade) and the target is valuable enough (imagine, for example, having a "valid" TrueCrypt executable), this is not in the realm of impossible anymore. Now, of course, the NSA will probably not outcompute the Bitcoin blockchain and transfering the hash rate is not that simple, but they do have a lot of power and cryptographers. What I'm trying to say is that the orders of magnitude are not in the "totally impossible" space anymore. Yes, you're probably safe, but given the availability of secure alternatives, there's really no reason not to get off the thin ice.
- deleted 6y ago
  [deleted]
- KarlKemp 6y ago
  This is not a cryptographic use of hashing, but just simplification/identification. There is nothing to gain from being able to impersonate some malware because you could always just include the malware itself to match any hash.
- 2cb 6y ago
  While MD5 hashes are insecure for hashing passwords or other sensitive data, they're still fine for verifying the integrity of data if you are simply verifying a file has not been corrupted. If MD5 was being used to verify a piece of software you actually want, it's not secure as it's not collision resistant. But since we can be quite sure no one has made a file that shares an MD5 hash with this new strain of malware, MD5 is sufficient as a checksum in this use case. You're correct to point out that newer hashes are still preferable though, simply to get out of the habit of using MD5 if nothing else. I assume you got downvoted because MD5's weaknesses aren't relevant in this specific instance. But still they could just have easily used SHA256.
- hn_throwaway_99 6y ago
  Because why not, what's the threat here? The purpose of the hash is so an investigator can easily check if a given package file is this malware. Note that (a) it is of course trivial for the malware author to change something in the package to change the hash, so a different hash is not a guarantee the package is clean and (b) the collision problems of MD5 aren't really a problem here, as why would someone else have an incentive to make their file falsely look like this malware. You were downvoted (or, rather, I downvoted you) for your knee jerk "MD5 BAD!" comment without thinking through what the problems would be, and worse, you took an aggressive tone from the beginning ("I can't wait to hear the apologists") that just makes you sound like a jerk.
  - a1369209993 6y ago
    > (b) the collision problems of MD5 aren't really a problem here, as why would someone [] have an incentive to make their file falsely look like this malware. While your overall point is correct, there is a specific tactic where a collision attack would be useful: make two md5-colliding versions of the virus that behave subtly differently, in a attempt to make researchers throw out useful hypotheses about how it works because someone already determined that (the other version of) it didn't actually do that.
- A12-B 6y ago
  I knew a website that used MD5 to generate unique colors for usernames. There's a finite amount of colors in rgb colorspace and it doesn't really matter if you get a collision because it's just username colors. So there's definitely still a realistic place for md5 in this world.
- hamilyon2 6y ago
  You are actually right. Given how one can forge an md5 of any file, some malware authors could match a "signature" so to speak of a very popular useful file, leading to mass false detections, for example.
  - upofadown 6y ago
    MD5 is not broken in a way where that would be possible. The best that could be done by such a prankster would be to create two pieces of malware with the same MD5. I guess that could be confusing or something...
- nkrisc 6y ago
  Could you please explain why this specific use of MD5 is inappropriate? I don't really see how the weaknesses of MD5 are applicable here but I'd like to learn if I'm wrong.
_qulr 6y ago
PROTIP: Select your LaunchAgents and LaunchDaemons folders in /Library and ~/Library, select Folder Actions Setup in the Services menu, and enable folder actions. You can use "add - new item alert.scpt" to be notified whenever a new item is added to those folders. For even more protection, I flat out locked the folders ~/Library/LaunchAgents and ~/Library/LaunchDaemons in Finder, though this could interfere with some software you use.
- pingiun 6y ago
  Thanks this is a very useful tip, the folder actions in general seem pretty useful
- inspector-g 6y ago
  There’s also the fantastic app BlockBlock to help with this. Notifies you of changes to those folders and allows you to accept/deny whatever an app is trying to change.
  - vagrantJin 6y ago
    This is super useful. Thanks for sharing. I wish there was something out there where I could always see/check what folders are changed and what program is making external http calls to dodgy IPs. Then block the good jesus out of them.
    - mkskm 6y ago
      The same devs also make LuLu, an application firewall similar to Little Snitch: https://github.com/objective-see/LuLu https://github.com/objective-see/LuLu
  - mkskm 6y ago
    Another option is Lingon X. It provides a GUI for launchd and includes a notification setting under Preferences > Notifications for items being added/removed. https://www.peterborgapps.com/lingon/ https://www.peterborgapps.com/lingon/ https://www.peterborgapps.com/lingon/#preferencesnotifications https://www.peterborgapps.com/lingon/#preferencesnotificatio...
JadeNB 6y ago
Specifically, here's the list of indicators common to v1 & v2, quoted from the article: > ~/Library/._insu (empty file used to signal the malware to delete itself) > /tmp/agent.sh (shell script executed for installation callback) > /tmp/version.json (file downloaded from from S3 to determine execution flow) > /tmp/version.plist (version.json converted into a property list)

by Gys 6y ago

2cb 6y ago

Sounds like this was discovered by MalwareBytes so if you have that installed a scan should let you know too. Also, Little Snitch will show you the connections it makes every hour. Before anyone says it - in macOS 11.2, Apple removed the exclusion list that allowed their own software to bypass firewalls.[1] [1] https://blog.obdev.at/a-wall-without-a-hole/ https://blog.obdev.at/a-wall-without-a-hole/

TacticalCoder 6y ago

The guys at redcanary.com are giving cryptographic hashes as... MD5. 2021. MD5. I can't wait to hear the apologists. EDIT: instead of downvoting it would be nice to explain why it's fine to use and encourage the usage of MD5 in 2021.

jcrawfordor 6y ago
I hate to be an apologist, but MD5 is the norm in IOCs for two reasons: 1) All of the tools expect and produce MD5 because it is the convention. Computing MD5 hashes of every file on disk or passing through a network is a relatively common forensic operation right now, SHA256 is not. 2) IOCs are not intended to be used in scenarios in which a malicious collision presents a problem (no one would want to... mask their malware to still look like malware?) so there is little downside to carrying on the convention. While I would recommend against MD5 in most modern applications, if nothing else to avoid having discussions like this all the time, before upsetting an entire ecosystem of tools it is important to consider whether or not the known weaknesses of MD5 actually pose a problem. In this case, a matching hash is the bad state, and so there is no real impact of a preimage attack.
Sebb767 6y ago
I didn't downvote you, but this use case of MD5 is fine - you want to verify whether the binary matches the one they have. You could spend a few hundred bucks on AWS to have a binary which matches that as well, but what would be the point - have users delete it? Now, if you used it to verify whether a binary was _secure_, this would be problem. But in this case, the (still unlikely) possibility of a false positive is not really a threat.
- gruez 6y ago
  >Now, if you used it to verify whether a binary was _secure_, this would be problem Even that's probably fine. Collision attacks require the attacker to control both inputs. In the case of code signing this would mean the publisher is in on it, in which case you're already screwed.
  - Sebb767 6y ago
    > Collision attacks require the attacker to control both inputs. Technically, no. It gets a lot easier when you only need to find any pair of inputs which produce a collision, but with computing power increasing a lot and md5 being very broken, it is feasible that a determined attacker with a lot of compute power can create a collision with a fixed hash, or at least will be able to in the somewhat near future. I'd agree that you're reasonably secure, but when you need security, you shouldn't bother with outdated tech when secure and future-proof alternatives are readily available.
    - gruez 6y ago
      >it is feasible that a determined attacker with a lot of compute power can create a collision with a fixed hash That's a preimage attack, which is a much higher bar. Even for md5 there hasn't been much progress made: https://en.wikipedia.org/wiki/MD5#Preimage_vulnerability https://en.wikipedia.org/wiki/MD5#Preimage_vulnerability
      - Sebb767 6y ago
        The referenced paper is from 2009 and points out a complexity of 2^123 (or roughly 10^27). Bitcoin miners currently put out ~150 EH/s, so about 10^17. Only judged by the rounds, double-sha256 (Bitcoin) has 128 and md5 has 4, so let's assume they'd do 10^18 hashes per second on md5. So it would take them about 31 years to find a collision. If the NSA found a way to get the complexity down a bit more (they had a decade) and the target is valuable enough (imagine, for example, having a "valid" TrueCrypt executable), this is not in the realm of impossible anymore. Now, of course, the NSA will probably not outcompute the Bitcoin blockchain and transfering the hash rate is not that simple, but they do have a lot of power and cryptographers. What I'm trying to say is that the orders of magnitude are not in the "totally impossible" space anymore. Yes, you're probably safe, but given the availability of secure alternatives, there's really no reason not to get off the thin ice.
deleted 6y ago
[deleted]
KarlKemp 6y ago
This is not a cryptographic use of hashing, but just simplification/identification. There is nothing to gain from being able to impersonate some malware because you could always just include the malware itself to match any hash.
2cb 6y ago
While MD5 hashes are insecure for hashing passwords or other sensitive data, they're still fine for verifying the integrity of data if you are simply verifying a file has not been corrupted. If MD5 was being used to verify a piece of software you actually want, it's not secure as it's not collision resistant. But since we can be quite sure no one has made a file that shares an MD5 hash with this new strain of malware, MD5 is sufficient as a checksum in this use case. You're correct to point out that newer hashes are still preferable though, simply to get out of the habit of using MD5 if nothing else. I assume you got downvoted because MD5's weaknesses aren't relevant in this specific instance. But still they could just have easily used SHA256.
hn_throwaway_99 6y ago
Because why not, what's the threat here? The purpose of the hash is so an investigator can easily check if a given package file is this malware. Note that (a) it is of course trivial for the malware author to change something in the package to change the hash, so a different hash is not a guarantee the package is clean and (b) the collision problems of MD5 aren't really a problem here, as why would someone else have an incentive to make their file falsely look like this malware. You were downvoted (or, rather, I downvoted you) for your knee jerk "MD5 BAD!" comment without thinking through what the problems would be, and worse, you took an aggressive tone from the beginning ("I can't wait to hear the apologists") that just makes you sound like a jerk.
- a1369209993 6y ago
  > (b) the collision problems of MD5 aren't really a problem here, as why would someone [] have an incentive to make their file falsely look like this malware. While your overall point is correct, there is a specific tactic where a collision attack would be useful: make two md5-colliding versions of the virus that behave subtly differently, in a attempt to make researchers throw out useful hypotheses about how it works because someone already determined that (the other version of) it didn't actually do that.
A12-B 6y ago
I knew a website that used MD5 to generate unique colors for usernames. There's a finite amount of colors in rgb colorspace and it doesn't really matter if you get a collision because it's just username colors. So there's definitely still a realistic place for md5 in this world.
hamilyon2 6y ago
You are actually right. Given how one can forge an md5 of any file, some malware authors could match a "signature" so to speak of a very popular useful file, leading to mass false detections, for example.
- upofadown 6y ago
  MD5 is not broken in a way where that would be possible. The best that could be done by such a prankster would be to create two pieces of malware with the same MD5. I guess that could be confusing or something...
nkrisc 6y ago
Could you please explain why this specific use of MD5 is inappropriate? I don't really see how the weaknesses of MD5 are applicable here but I'd like to learn if I'm wrong.

_qulr 6y ago

PROTIP: Select your LaunchAgents and LaunchDaemons folders in /Library and ~/Library, select Folder Actions Setup in the Services menu, and enable folder actions. You can use "add - new item alert.scpt" to be notified whenever a new item is added to those folders. For even more protection, I flat out locked the folders ~/Library/LaunchAgents and ~/Library/LaunchDaemons in Finder, though this could interfere with some software you use.

pingiun 6y ago
Thanks this is a very useful tip, the folder actions in general seem pretty useful
inspector-g 6y ago
There’s also the fantastic app BlockBlock to help with this. Notifies you of changes to those folders and allows you to accept/deny whatever an app is trying to change.
- vagrantJin 6y ago
  This is super useful. Thanks for sharing. I wish there was something out there where I could always see/check what folders are changed and what program is making external http calls to dodgy IPs. Then block the good jesus out of them.
  - mkskm 6y ago
    The same devs also make LuLu, an application firewall similar to Little Snitch: https://github.com/objective-see/LuLu https://github.com/objective-see/LuLu
- mkskm 6y ago
  Another option is Lingon X. It provides a GUI for launchd and includes a notification setting under Preferences > Notifications for items being added/removed. https://www.peterborgapps.com/lingon/ https://www.peterborgapps.com/lingon/ https://www.peterborgapps.com/lingon/#preferencesnotifications https://www.peterborgapps.com/lingon/#preferencesnotificatio...

JadeNB 6y ago

Specifically, here's the list of indicators common to v1 & v2, quoted from the article: > ~/Library/._insu (empty file used to signal the malware to delete itself) > /tmp/agent.sh (shell script executed for installation callback) > /tmp/version.json (file downloaded from from S3 to determine execution flow) > /tmp/version.plist (version.json converted into a property list)