OS X Crimeware Kit Emerges

Trailrunner7 writes "Crimeware kits have become a ubiquitous part of the malware scene in the last few years, but they have mainly been confined to the Windows platform. Now, reports are surfacing that the first such kit targeting Apple's Mac OS X operating system has appeared. The kit is being compared to the Zeus kit, which has been one of the more popular and pervasive crimeware kits for several years now. A report by CSIS, a Danish security firm, said that the OS X kit uses a template that's quite similar to the Zeus construction and has the ability to steal forms from Firefox." Mac users are also being targeted by a new piece of scareware called MAC Defender.

Comments

Masses reaction

[TaoPhoenix]

"It can't be! Macs don't get malware! Protect us, Steve J!"

Re:Masses reaction

[fuzzyfuzzyfungus]

Not to worry, my faithful, mandatory binary signing will be here soon enough.

Sent from my iPad.

Re:Masses reaction

[jo_ham]

Not wanting to go for a cheap "FTFY", I'll just say that the reaction of everyone imitating a Mac user's reaction will be yours.

The rest of us actual Mac users carry on as normal, just like the Linux users.

Interestingly, does this count as the 44th malware threat on OS X (based on a cited post from the AV thread yesterday that said there are 43 threats over the life of OS X), or does it count as more than one, since it's a tool kit. Is a swiss army knife one tool or several? :p

Re:Masses reaction

[bmo]

Nobody with a brain has ever claimed that OSX is impervious. And nobody with a brain has ever claimed that OSX is impervious to PEBCAK.

What *has* been claimed is that the automatic propagation of evil over OSX (and BSD and Linux and *every other sane OS out there*) is terribly inefficient, because unless you pack the evil in a container, permissions (including the permission to execute) are stripped as soon as you send your file. And then you have to either unpack it or you have to manually assign the execute bit through right clicking and using the dialog or using chmod. And only then can you run the file.

Compare and contrast this to the Windows world where the execute bit is tied to 3 letters in the file name and Windows will duly execute the file as soon as it's double-clicked. Malware in this system goes from machine to machine because Windows assumes that a file is permitted to execute if it whispers the correct shibboleth of "exe, com, scr" or what have you.

While OSX's advantage of using the Unix model of tossing permissions does not cover warez, the equivalent of purple gorillas on OSX or braindead users, even the small amounts of protection that OSX gives goes a long way in preventing network effects on the spread of malware.

--
BMO

Re:Masses reaction

[melikamp]

The funny thing about signing binaries, it only helps to authenticate the author and to defend against the random memory corruption. It does nothing at all for defending from things like local and remote exploits, which corrupt the memory intentionally by using bugs already present in the signed binaries.

Re:Masses reaction

[errandum]

You miss the point, I think.

Whoever double clicks something to install assuming it is legit will also gladly insert their username/password.

In terms of security windows is actually more robust from a security standpoint than mac os, but it's also targeted a lot more. And I don't mean file permissions, I mean actual design flaws.

You're safer while using a mac, no doubt about it. But the OS with the most security features IS windows.

And if you don't believe me, I'll quote:

"Paul Kocher, president and chief scientist at Cryptography Research: "The fair answer is that with the latest versions of each operating system there isn't a compelling security reason to pick one or the other. It used to be that Apple was doing a better job, but with Windows 7 Microsoft has caught up. There are some differences; Windows has a better security ecosystem. On the other hand, Apple tends to have more expensive hardware and has a smaller market share, so it attracts fewer malware writers. Both have security bugs. Both need patches. Both can be broken if someone finds a zero-day exploit."

or

"Charlie Miller, a principal analyst at consultancy Independent Security Evaluators: "Technologically speaking, PCs are a little more secure than Macs. Macs have a larger attack surface out of the box (Flash, Java, support for a million file formats, etc.) and lack some anti-exploitation technologies found in PCs like full ASLR [Address Space Layout Randomization]. This means Macs have more vulnerabilities and it's easier to turn a vulnerability into an exploit on the platform. Despite the fact it is less secure, paradoxically, Macs are actually safer to use for most people. This is because there simply isn't much risk of being exploited or installing malware."

or even

"Rich Mogull, CEO at Securosis: "It depends on which version of Windows we're talking about. Clearly there are major differences between Windows XP and Windows 7. Second is, are we talking about safety versus security? Microsoft has done more in terms of its inherent security features than Apple has in the operating system. All of that said, Microsoft gets attacked a lot more than Apple does. Right now your odds of being infected as a Mac user by malicious software are quite a bit lower than a Windows user, unless you do stupid things, such as download free versions of commercial software. And some of the pornography sites on the Internet, the dark corners of the Internet have stuff that will hurt a Mac."

It's not my opinion. It's the expert's opinion.

Re:Masses reaction

[cybermage]

Of course, Faust's deal with the devil was signed too.

Re:Masses reaction

[hairyfeet]

Actually, and I'll probably get flamed for saying this, you'd be surprised how many have bought the "you just can't infect a Mac!" meme. I got called into an SMB a few years back, where the guy instead of listening to me and paying me to set up a sensible top to bottom least permission approach bought into the "can't infect a Mac!" meme and then was shocked! shocked I tell you, when he found out he got pwned thanks to one of his kids wanting to watch a naughty video and getting the DNS changer bug.

You see the problem is something we that have been in the trenches for quite awhile (I started with Win 3.x, what was that? 20 years ago?) sadly run into far too often, it is what I like to call "magical thinking". it is the "If I use product X I won't have to change my habits or anything, and I'll be unhackable" bullshit. Hell I remember when firewall resellers were pushing the "if you have a firewall you are invisible and untouchable!" and it was bullshit then and it is bullshit now.

NEWS FLASH...ALL OSes can be hacked, full stop. ALL OSes are extremely complex pieces of code, with interactions on top of interactions with third party code thrown in the mix just for shits and giggles. There is NO perfectly unhackable OS and if there was one that person could hire Bill Gates to shine his shoes. The last real legitimate gripe about Windows, the brain dead "hey lets run everyone as admin!" finally died hard with Vista, so frankly all OSes are on about the same footing, as in TFA it all comes down to what the malware writer thinks is profitable.

Think OSX is immune? Read TFA. Think Linux can't be pwned? Look at the Android malware or the KDE screensaver malware that spread awhile back or even this handy how to guide on writing Linux malware.

The ONLY solution is a top to bottom least permissions approach, not magical thinking. Least permissions and users not being so brain dead they actively help the malware writer is the ONLY solution.

As a final note let me give a recent example. I set up a box, had it locked down nicely, required password for admin, least permissions, yet it got pwned in under 45 days. Did I miss something? Nope, the user decided he just had to have Limewire, even though I told him not to, so he disabled the antivirus because it wouldn't in his words "shut up" and then promptly gave permissions to Limewire to do whatever it wanted. And boy did it, 60+ pieces of malware.

So in the end it doesn't matter what the OS, it doesn't matter what kind of permissions model you set up, if you have someone with admin rights that says "I want my emails from Melissa and you WILL let me have them!" then no matter what OS, you're screwed. An OS is only as good as the PEBKAC sitting in front of it.

Well?

[fuzzyfuzzyfungus]

All I want to know is whether this malware is worthy of the Apple platform or not: Does it use Grand Central Dispatch to efficiently allocate the load of multiple form-stealing processes between all my system's cores? Are the misleading dialog boxes that frighten me further into folly fully compliant with Apple's HID guidelines?

If I'm going to get Mac malware, I damn well better have the best malware experience that the industry has to offer. Heck, I'd probably even be willing to pay $20 for something that windows users get for free and linux nerds compile from source, if the interface is good enough...

Re:Security through Obscurity = FAIL

[jo_ham]

Well, the answer will be "yes" - if you are stupid (which is harsh - let's say uninformed) enough to be fooled by the sorts of things that malware gets up to (like "click here for a free system check!" or "check it out, so sexy!!! - natalie-portmans-hot-grits.jpg.exe" then the penetration rate per-platform is going to be broadly similar. You're going to have a portion of your userbase who are susceptible to this, along with another portion who set blanket passwords for all of their activities and set it to "password1".

Windows has the problem that not only does it have to contend with this user problem (which is common to both platforms [win and OS X], and less common on Linux/non-Mac-BSD), but it has also faced the "swiss cheese operating system" problem that they have been trying to fix since malware first came about. OS X at least has the benefit of starting from a better platform (BSD core) than Windows' legacy issues. That's not to say it's immune to threats - the fact that there are security updates for OS X disprove that.

I'm surprised that there hasn't been a more high profile virus or malware outbreak on OS X before now, since even with the smaller marketshare (1 in 5 new computers sold in the US is a Mac, but total install base is still nearer 10%), the "kudos" for "sticking their nose in it" is high.

Re:Can someone tell me how "form stealing" works?

[Lord_Jeremy]

Assuming that this software is actually intended to be running on the "compromised" system (which I find no indication of in either TFA, the article it links to, or google results), then what it does is exploit FireFox to "hijack" cgi webscripts on websites and use them to send spam email. Pretty much it would send data through a web request to a page that's intended to send email (like forum registration perhaps) that would essentially make the email handler crash or open a backdoor and then inject spam email into the form that would get sent by the website's server. It's a clever way of getting around spam filters blocking known spam email carriers - if your spam is being sent from multitudes of legitimate websites that just have poor software security it's much harder to identify and block.

My big question is how this is supposed to get on the target system. To date, the only Mac OS X malware discovered in the wild has been virtually harmless, since it all comes in the form of a trojan. Some not very nice person disguises their malware in a piece of pirated software and upload it to torrent sites or whatnot. Some people download it and get infected because they don't realize the danger of such an occurrence. From what I've read, the security firms typically classify these trojans as extremely low-risk, with something like fewer than 50 confirmed infections. The point is, there are as yet no "drive by" or otherwise spontaneous infections you can get on a Mac. Any bad things that could happen rely on some form of social engineering or deception. The way OSes work, if you can convince an Administrator (of any system) to run something then you generally can do whatever you want. The Mac OS X security model is in many ways stronger than the Windows security model, but it's certainly not infallible. Macs are immune to the type of autorun viruses that are spread by removable media because they don't support automatic execution of programs on removable media (I can't for the life of me understand why the hell anyone would want autorun enabled on their system). On the other hand, the default OS X user/first one created is an Administrator. They aren't a superuser but things like global-scope installers have the permission to use the equivalent of 'sudo' if an Administrator enters their password. It's like UAC on Vista/7 - a large majority of people don't think twice about clicking "Yes" to whatever comes up on their screen (the other day my fiancé unwitting installed a browser toolbar and changed her home page on her PC because she didn't uncheck a few boxes in the installer for some freeware). I'd like to think that by being asked to enter a password a user is more likely to consider what they're authorizing but in most cases, the user is the weakest link.

Re:Idiotware?

[joh]

The difference is that only very few Mac apps require an admin password since most are just bundles you throw into your Applications folder (or where you want them to be) without actually "installing" (= spraying files and data all over the system) anything.

Maybe not a really huge difference, but most people are not really used to that and any app running an actual installer is eyed with suspicion.

It would help a lot if apps like Adobe Reader wouldn't needlessly come with such an installer. But then it's very nearly malware anyway.