Slashdot Mirror
WireLurker Mac OS X Malware Found, Shut Down
msm1267 writes WireLurker is no more. After causing an overnight sensation, the newly disclosed family of Apple Mac OS X malware capable of also infecting iOS devices has been put to rest. Researchers at Palo Alto Networks confirmed this morning that the command and control infrastructure supporting WireLurker has been shut down and Apple has revoked a legitimate digital certificate used to sign WireLurker code and allow it to infect non-jailbroken iOS devices.
Researchers at Palo Alto Networks discovered and dubbed the threat WireLurker because it spreads from infected OS X computers to iOS once the mobile device is connected to a Mac via USB. The malware analyzes the connected iOS device looking for a number of popular applications in China, namely the Meitu photo app, the Taobao online auction app, or the AliPay payment application. If any of those are found on the iOS device, WireLurker extracts its and replaces it with a Trojanized version of the same app repackaged with malware.
Patient zero is a Chinese third-party app store called Maiyadi known for hosting pirated apps for both platforms. To date, Palo Alto researchers said, 467 infected OS X apps have been found on Maiyadi and those apps have been downloaded more than 350,000 times as of Oct. 16 by more than 100,000 users.
Researchers at Palo Alto Networks discovered and dubbed the threat WireLurker because it spreads from infected OS X computers to iOS once the mobile device is connected to a Mac via USB. The malware analyzes the connected iOS device looking for a number of popular applications in China, namely the Meitu photo app, the Taobao online auction app, or the AliPay payment application. If any of those are found on the iOS device, WireLurker extracts its and replaces it with a Trojanized version of the same app repackaged with malware.
Patient zero is a Chinese third-party app store called Maiyadi known for hosting pirated apps for both platforms. To date, Palo Alto researchers said, 467 infected OS X apps have been found on Maiyadi and those apps have been downloaded more than 350,000 times as of Oct. 16 by more than 100,000 users.
Why take a risk in going beyond the walden garden for a bloody photo-app, while in paradise there exist countless photo-apps for free?
'it just works' something something... insert witty remark here
Some lessons are never learned.
Life is not for the lazy.
This is what I like about proprietary software. Lots of eyeballs are probing for vulnerabilities, and when such are found, they are fixed quickly by professional paid developers.
Now, can we please put to rest this applefanatic idea that "mac's can't get a virus"?
This is not the same as preventing the vulnerability. It's just taking away the control center. it does not prevent someone from doing it again in the future so stop thinking you're safe because you run a Mac.
BeauHD. Worst editor since kdawson.
There is a PDF report on the main website for Unit42 about the malware, but it has a fairly invasive registration process. Signed up with bs info and uploaded to public google drive for everyone.
Link to the researchers website for those cautious about the gdocs link
Straight Link to the report (requires registration)
Have not read the technical details yet, but it looks fairly comprehensive.
Really, the story here is that the malware was signed by a valid certificate. This basically means the certificate system is worthless. That is a far bigger threat than any single malware.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Mac's are only as vulnerable as Windows, etc... if you only allow for two levels of vulnerability: Vulnerable, and Invulnerable.
(BTW, if you used your OS X machine the way any sane Unix or GNU/Linux user does, and you don't do daily tasks from an administrator account... you are apparently not at risk from this malware. Why would you use your OS X machine the same way someone whose computer runs Unix does? Because underneath all the pretty, flowery goodness and pretty special effects in OS X,... IT'S UNIX!!! Duh.)
If you instead look at the ODDS of how likely you are to see adverse consequences that come exclusively from your choice of platform... Windows flaws & vulnerabilities are so rampant that many people stopped hacking them because they saw it as no meaningful challenge. This is where the term "script-kiddie" comes from. Hacking became something you could do with a trivial snippet of code someone else wrote.
Windows security has always been a joke. This is probably because Microsoft uses the in-built security flaws as an anti-piracy measure. You'd have to have your HEAD EXAMINED if you use a Windows PC without Windows update, unless it's got NO connectivity hardware, no speaker, and no microphone, no floppy drive, no externally accessible ports, basically, a "stand-alone, black box." Otherwise, you're begging for trouble. In fact, Windows for years required you to have anti-virus/anti-spyware/anti-malware/anti-worm/anti-intusion software that you got elsewhere to patch up the gaping security holes left in their own software. What garbage!
I don't know if this is still true because for about half a dozen years, I have been Microsoft free. Never been happier! No more blue-screens of death that I used to see ALL. THE. TIME... no more "WARNING! YOUR COMPUTER HAS A VIRUS!!!" no more "CAUTION: YOUR COMPUTER IS UNPROTECTED!" and DEFINITELY no more "We are no longer supporting your operating system. If you want to continue to receive security updates, you'll have to pay us another couple hundred dollars for another new version of our wretched, lousy, buggy, unsecure-by-design 'Operating System' Hahahahahh Pay us, bitch!"
Now I get my OS updates for free, and my computer is much slicker, has better features, longer battery life, and interoperates with all my other technology.
When you have millions of users, and millions of developers all writing millions of pieces of software, one thing slips by, and suddenly all the Microsoft Win-SLAVES are crowing or braying like jackasses. Does anyone even track Windows vulnerabilities anymore? Or do we just go ahead and assume its an almost daily occurrence, no longer worthy of note?
Too bad OS X is opensource.
http://opensource.apple.com/
We should all switch to a truly proprietary OS. Anyone has any advice on which truly-proprietary OS is better security-wise ?
You obviously didn't read the page you posted. Go back, actually READ it, then come back and make your comments when you know what you're talking about.
OS X DOES INCORPORATE open source software, and contributes to the development of many projects that are used in OS X. BUT... OS X itself is NOT open source. You can't get a copy of the entire OS' source code, compile it yourself, and run it on any arbitrary machine. It is designed to run on Apple built hardware designed to use THIS particular operating system.
They do, sadly, not support their own older hardware with new software, but since they are a HARDWARE company, Apple can't be blamed for not, any more than you could blame Microsoft for the fact that Windows 8 won't run on a 4.77 MHz IBM 5150 PC from circa 1981 using Intel's 8 bit interface, 8088 microprocessor chip, even if Microsoft made the PC themselves, rather than entering a licensing agreement (which they did,) with IBM to supply the OS to their original Personal Computer.
It would be nice if Apple committed to say, a decade, or a dozen years. When Mavericks came out, (last year, 2013, right?) only Macs built in 2007 or after could run it, which is only about a half-dozen years. This may seem like an eternity for high-tech, but it's kind of a short span of time for most anything else.