MacControl Trojan Being Used In Targeted Attacks Against OS X Users

Trailrunner7 writes "Welcome to the age of targeted attacks, Mac users. Perhaps having grown tired of owning Windows machines around the world for the last few years, attackers have now taken up the challenge of going after Macs with the same kind of targeted attack tactics that have served them so well in the Windows world. Researchers have found a new attack that employs two separate pieces of malware, a malicious Word document and some techniques for maintaining persistence on compromised machines, and the campaign is specifically targeted at Mac users. The command-and-control domain involved in the attack is located in China and the attack exploits a three-year-old vulnerability in the way that Office for Mac handles certain Word files, according to researchers at AlienVault, who discovered and analyzed the attacks."

Comments

Microsoft (:

[Anonymous Coward]

Now how cool is that. A new threat is found for the Mac platform and it's in a Microsoft product of course.
It's an improvement on the previous round, though. Last time it was about malware that required you to actually install it :D

Re:Microsoft (:

[Grishnakh]

Since when was the US Government in the business of doing things for the good of humanity?

Re:Microsoft (:

[recoiledsnake]

Now how cool is that. A new threat is found for the Mac platform and it's in a Microsoft product of course.
It's an improvement on the previous round, though. Last time it was about malware that required you to actually install it :D

However, it's an interesting counter-point to the commenters who regularly comment(and get modded up to 11) "How about MS fix security in Windows instead of taking down botnets/shipping antivirus etc.). There is no way to secure an OS from application exploits short of iOS style lockdown, which these very commenters would slag as "TAKING AWAY MY FREEEDOMZZZ". Sorry, but blaming Windows holes has become passe, especially after malware for OS X and Android(run on a Linux kernel which we are told is secure compared to Windows) has come out.

Re:Microsoft (:

[Nerdfest]

An iOS style lock-down wouldn't help. It could just as easily been another piece of software, they tend to pick those that are widely deployed.

Re:Microsoft (:

[mjwx]

There is no way to secure an OS from application exploits including of iOS style lockdown, which these very commenters would slag as "TAKING AWAY MY FREEEDOMZZZ". Sorry, but blaming Windows holes has become passe, especially after malware for OS X and Android(run on a Linux kernel which we are told is secure compared to Windows) has come out.

Fixed that for you.

Remember that IOS gets exploited regularly, including remote exploits like JailbreakMe.com.

Re:Microsoft (:

[am 2k]

The new "gatekeeper" feature would be able to lock down MS Word and the worst that could happen is your documents folder is wiped. But since MS Word would never appear on the Mac App Store users would have installed it with unsigned access. Which would only affect their home directory unless they run as Admin.

Uh, I don't think you know what you're talking about. Gatekeeper is a new thing in 10.8, which only allows stuff that's signed either with an App Store certificate or a Mac developer certificate. It doesn't handle file access at all.

Sandboxing (new in 10.7) limits file (and other device) access to only certain areas, but the documents folder is usually off limits.

If Word would use a Mac developer certificate, starting in 10.8 Apple could pull the kill switch and the application would not launch on any Mac any more. However, that's quite a drastic step and would probably not be done in this case for such a widely-deployed piece of software.

I guess that's what you get for using Microsoft

[Grishnakh]

Interesting that this Mac exploit only applies to Mac users who use Microsoft Word. Not saying that Macs are ultra-secure, but maybe the malware authors are just going after the low-hanging fruit, which is Microsoft software, regardless of what platform it's installed on.

Maybe this is how MS will finally put to rest the notion that Linux is more secure than Windows: they'll release MS Office For Linux, which will then open Linux users up to the same level of insecurity Windows users have had forever.

Re:I guess that's what you get for using Microsoft

[bmo]

Interesting that this Mac exploit only applies to Mac users who use Microsoft Word

When you include a scripting language in your document spec, expect people to use it.

Good people and bad people.

--
BMO

Re:I guess that's what you get for using Microsoft

[v1]

Writing a macro language for your anything that has the ability to silently add/edit the macros in other unrelated documents is just nine kinds of stupid.

10,000 hipsters abandon the Mac

[hessian]

It's gone mainstream. Now that it has viruses, it's like the Miley Cyrus of computing.

Time to find something more obscure. OpenVMS on an Atom system with a retro GEOS interface. That's the ticket.

I used to like Apple before it was mainstream, but now I've moved on. Just like with White Ring and fixies.

Don't blame Microsoft...

[t4ng*]

Any OS that can be pwned by an exploit in *any* software running in user mode is insecure. Sorry, but those are the facts.

The reason for using an exploit in MS-Office is because is one of the most commonly used software products on Macs since its very beginning. So developing an exploit that uses a commonly used software means a better chance of spreading it.

patched three years ago

[MushMouth]

Actually this is what you get when you shut/put off updates.

Meh?

[Anubis IV]

Macs had a flurry of trojans that hit them last year too. Apple put out the 10.6.8 update that allowed them to deliver daily anti-malware updates, and then used it to block every variant of the trojan within a matter of hours after it first appeared. Since 10.6 or above has been the default on all new Macs for the last 2.5 years, and Software Update is enabled by default to regularly check for updates, you can bet that the vast majority of Mac users will be receiving an automatic anti-malware update sometime later this week or next to deal with the trojan.

Re:LoL

[Architect_sasyr]

I spend my days working as a mac tech, so no, I really do not. I am, however, still highly amused that it happens this way. In much the same fashion as I am amused when wine is used to exploit a linux box.

Re:LoL

[lightknight]

That's quite alright. We find things that target Safari on Windows all the time, so I guess it's more of the same.

Re:Office for Mac?

[Centurix]

Embrace, Penetrate, Ejaculate.

The upcoming Microsoft memo.

Re:LoL

[sg_oneill]

I spend my days working as a mac tech, so no, I really do not. I am, however, still highly amused that it happens this way. In much the same fashion as I am amused when wine is used to exploit a linux box.

You may laugh, but its truer than you think. Many many moons ago I was admining a small network of linux desktops for students at the local university. Management , non technnical of course, demanded that internet explorer be installed on them. After protesting loudly and losing the argument, I ended up deploying ie6 across the network via wine. It took aproximately 3 days before they became infested.

In a strange way, I took that as a surprising confirmation of wine's compatibility.

In the end I replaced the Mozilla browsers icons with E icons and the office twonks where happy. God I hate tech support

Re:Sounds like a vulnerability in a Microsoft prod

[otuz]

Apple is actually sandboxing all apps by default in 10.8 "Mountain Lion"

Re:LoL

[omfgnosis]

I still don't understand this attitude, but I can count myself (a Mac user) lucky as a consequence. If I were trying to profit from exploiting home PCs, I would target the Mac first and foremost, as the userbase is substantial (millions), demographically wealthy (compared to the whole market) and typically security-ignorant. That's a perfect storm for exploiting for profit, and I'm frankly astonished it hasn't happened on a large scale yet.