Slashdot Mirror
Apple Has Shut Down the First Fully-Functional Mac OS X Ransomware (techcrunch.com)
An anonymous reader writes: Apple has shut down what appears to have been the first, fully-functional ransomware targeting Mac computers. This particular form of cyber threat involves malware that encrypts the data on your personal computer so you can no longer access it. Afterwards, the hackers request that you pay them in a hard-to-trace digital currency — in this case, bitcoin — in order for you to retrieve your files. This ransomware, called KeRanger, was first reported by researchers at Palo Alto Networks. They also noted that Apple has now revoked the abused certificate that was used in the attack and updated its built-in anti-malware system XProtect with a new signature to protect customers.
Apple?
I am Slashdot. Are you Slashdot as well?
I thought certs where going to protect us from this mess. It is nice that Apple yanked this cert, but what is to stop another cert from being bought and used to do the same damn thing?
Aren't Slashdot editors supposed to read Slashdot? We already saw that story earlier today.
Apple can't have any one else cutting in to there business.
The article seems to have said nothing.
You do realize that you can disable System Integrity Protection, the thing that stops you removing your kernel, C library and such?
Congratulations Mac, you final have a large enough installed base that malware developers are starting to support your platform. Maybe someday game developers will support it as well.
Gatekeeper is the real problem. It only checks the certificate on the first app in a package, then lets any other app, legit or malware, through without checking. Bundle in malware and it gets right through. Apple only blocks the certificate the developer of Transmission was using. So, all they are doing is blocking the first app's certificate, Transmission. That's just a bandaid patch on the real problem, Gatekeeper itself. All that has to be done is to repackage the same malware with the new app, or some other app, and it will happen again.
Apple, Microsoft, etc. should fund a hit squad to find people like this and quietly dispose of them.
The way I see it, they tweaked their walled garden a bit to protect against THIS specific strain of the ransomware.
Hardly impressive. Hardly news.
What WILL be interesting - in a depressing kind of way - is when this sort of attack begin hitting Apple computers more frequently. I'd like to know if Apple is prepared to deal with that, and how (other than telling their customers "Wipe disk, restore backup").
They were.
It's really Apple just playing catch up. I mean this was their first instance of ransom ware , and Windows has had it for how long ?
Apple copy catting again.
And they couldn't help themselves and got all control freaky , shutting it down with their mind control rays. None of this letting ransom ware to fester in the wild for years.
FFS, it was a viable commercial malware product, that had its ROI shut down inside 32 hours of its release into the wild. That's great cooperation between Palo Alto, Appke & the Transmission project.
Do you really think it paid off for the malware authors in that time , and they are simply laughing all the way to the bank ?
The difference is that all of the XProtect & related functionality can be disabled. It’s not easy to disable it (easy in the sense you’d stumble on it accidentally), and your average parent / grandparent user of Mac OS would never figure out how to disable it. Which is good, because they have no clue of the implications of doing so.
If as a trained and knowledgable IT professional, you want to run completely unprotected, you set some kernel flags in your EFI, and reboot. Execute whatever you like, overwrite anything on the drive as root, no questions asked. That’s probably not a great idea as the vast majority of the time those features protect even seasoned (or is that salty) professionals from shooting themselves in the foot. But if you really want to run something Apple has determined to be dangerous, you can still do it.
My opinion of Apple would fall sharply if they ever removed the disable options on their desktop OS. So long as that option is there, having it default to ON is the right option for the vast majority of users.
This incident had nothing to do with what you describe. And was stopped because the offending certificate got yanked and blocked by Apple, so in this instance Gatekeeper worked exactly as it should.
What you're talking about is a problem, no question 'bout that, just not this time
Software developers invested this much effort in finding legitimate uses for Bitcoin? Crapware like this only helps to reinforce the notion that Bitcoin is only used by the criminal underground.
So if you've already been infected and locked, this seems like it would shut down any avenue of unlocking your files. Maybe there aren't already people actively locked, but this seems like it would be a problem. Anyone know any more?
Apple can't have any one else cutting in to there business.
Where business? Your post doesn't make a damn bit of sense.
They celebrate ignorance.
Apple is depriving these software writers of their rightful revenue, and hopefully they'll be sued for it, and better yet a law passed banning this kind of practice. This is no different than ad-blocking and script-blocking software, which prevents upstanding advertisers from running JavaScript software on peoples' computers and rightfully earning revenue from it.
Mac OS X does *not* have a walled garden. A user is free to install any app downloaded from the internet. Mac OS X will warn them and ask if they really want to do this and then proceed as the user says.
They've already started by making it so that even root is blocked from editing files in locations such as /etc, /usr, and /bin, and blocks root from removing "important system apps" like iTunes and Photos (both of which have third party competitors).
Do they also prevent you from installing those competitors and prevent the competitors from registering to handle the file types handled by default by iTunes and Photos?
Apple would decompile the code for the malware and file a patent on it. Then dispatch the FBI to stake out the courthouse in Tyler, TX until the malware writers file a troll suit.
Well, that was fast. One day.
Sure, it's not a system patch but a certificate revocation, but still a responsibly swift resolution.
BTW, it was a malware Trojan, likely a double-Trojan, injected between the unwitting developer and the unwitting downloader, using the compromised certificate. Whether in transit if http downloaded, or by some other exploit, I dunno. Those more expert than me can answer that one.
It was not a virus. It was a Trojan inserted by a third party. I understand that it (probably) affected Linux and Windows as well. Please, everyone, just use proper terminology. It aids discussion.
The real version is coming, and to Timmy.
Ha ha haa hah hah ha hah ha hWeee hahah hahh ahh Eeee
Bit coin is neither anonymous nor hard to trace. How long must we put up with this shitty reporting of disinformative nonsense?
At https://m.youtube.com/watch?v=dQw4w9WgXcQ
I live in fear that some ransomware is going to encrypt my collection of ASCII porn, so I've been printing it out little by little on my Okidata 320. The good news is that I'm protected from ransomware, but the bad news is my house is now a serious fire hazard. Stacks of paper everywhere.
You are welcome on my lawn.
XProtect isn't the same as rootless.
You're right, to disable rootless (which protects a bunch of system files from being modified/deleted, even as root) you can do this.
XProtect is a signature-based anti-malware system - Apple pushes out silent updates to the signature definitions on a regular basis, but XProtect doesn't save you from shooting yourself in the foot when running as root.
Specialist Mac support for creative pros, Melbourne
I wonder how useful it would be to keep a "Ransomware canary" around. I'm thinking of, say, a Word .doc file on a network drive. A process on some separate computer then checks its entropy every few minutes to make sure it has not grown huge.
The idea fails for local files because (as I recall) the more sophisticated ransomware inserts itself as a filesystem driver.
XProtect does one other thing that is very welcome in most circumstances as well - expiring old versions of browser plug-ins like Java and Flash, which are known to have massive gaping security holes in them.
And, again, if this gets in the way of a proper administrator who is saddled with some ancient piece of shit that requires some ancient plug-in, it can be disabled on a per-plug-in level
Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
Do they also prevent you from installing those competitors and prevent the competitors from registering to handle the file types handled by default by iTunes and Photos?
Yes. Not file types, but there are certain behaviors that will always activate iTunes and Photos and there's no way to change them.
Plug an iDevice in, iTunes will always launch. Plug in a set of earbuds that have a "play" button on them, and that Play button will always launch iTunes. Plug in a camera or connect anything OS X considers camera storage (basically anything that's FAT with DSIM on it) and that will always launch Photos.
There is no way to permanently change this behavior, to the point where the recommended method of using a third party photo suite was to "sudo rm -rf /Applications/Photos.app" - which you can't do any more. (The recommended method of dealing with iTunes was to use Automator to create a .app that did nothing and replace iTunes with that. Can't do that anymore, either.)
The key word in what I just said was "permanently" because I'm sure someone will pop up and explain how you can change the default for a single device. There's no way to change it for ALL devices or for devices OS X constantly mistakes as being different. And there's absolutely no way to prevent Play from launching iTunes.
And, of course, the key is "for now." Given the direction Apple is going, it wouldn't be surprising in the slightest if they started blocking apps not downloaded through the App Store. Like, say, Firefox, or any of the various UNIX toolchains compiled for OS X that are available.
Microsoft bows to Hollywood and the Feds while dragging its heels while users suffer from malware.
Apple tells the Feds to take a hike and focuses its resource to kill a nasty ransomware within a day.
Go Apple!
Eternity: will that be smoking, or non-smoking? I Corinthians 6:9-10
What you have just said is tantamount to saying this:
"I'm not smart enough to figure it out and if I was then the first thing I'd do is shoot myself in the foot because I want to be the boss of me. You're not the boss of me!"
You *can* (fairly easily) do each and everything you're complaining that you can't do. It's not even difficult. That you don't know how to is a good indicator that you're unqualified to do so. However, if you want to do so then you can - it just means that you're an idiot. It is not complicated - I know how to do it (at least I know the process) and I'm not even an OS X user.
Sure, it is a fine sentiment to want to be in control. And you can be. You're just not qualified to be. We can tell you're not qualified to be. If you were, you'd know how to do this.
"So long and thanks for all the fish."
There is no way to permanently change this behavior, to the point where the recommended method of using a third party photo suite was to "sudo rm -rf /Applications/Photos.app" - which you can't do any more.
...unless you turn off System Integrity Protection.
Plug an iDevice in, iTunes will always launch. Plug in a set of earbuds that have a "play" button on them, and that Play button will always launch iTunes. Plug in a camera or connect anything OS X considers camera storage (basically anything that's FAT with DSIM on it) and that will always launch Photos.
There is no way to permanently change this behavior
Unless you uncheck the "Always open when connected" box in iTunes and Photos. Of course, you'd have to not be retarded first, so good luck with that.
I'm glad they finally got rid of iTunes... oh wait...
Unless you uncheck the "Always open when connected" box in iTunes and Photos. Of course, you'd have to not be retarded first, so good luck with that.
Yeah, that checkbox doesn't exist. Nice try.
There's absolutely no way to disable them, permanently, from ever launching. It cannot be done. Believe me, I've looked.
This capability is not one Apple came up with. It has long been a capability of FreeBSD and probably other BSD systems. It can be overridden if you know what you are doing, but it is an added safety belt to save you from yourself.
Kevin Oberman, Network Engineer, Retired
You can definitely turn off all that auto-launch-on-iDevice-plugin stuff.