Slashdot Mirror
Malwarebytes Discovers 'First Mac Malware of 2017' (securityweek.com)
wiredmikey writes: Security researchers have a uncovered a Mac OS based espionage malware they have named "Quimitchin." The malware is what they consider to be "the first Mac malware of 2017," which appears to be a classic espionage tool. While it has some old code and appears to have existed undetected for some time, it works. It was discovered when an IT admin noticed unusual traffic coming from a particular Mac, and has been seen infecting Macs at biomedical facilities. From SecurityWeek.com: "Quimitchin comprises just two files: a .plist file that simply keeps the .client running at all times, and the .client file containing the payload. The latter is a 'minified and obfuscated' perl script that is more novel in design. It combines three components, Thomas Reed, director of Mac offerings at Malwarebytes and author of the blog post told SecurityWeek: 'a Mac binary, another perl script and a Java class tacked on at the end in the __DATA__ section of the main perl script. The script extracts these, writes them to /tmp/ and executes them.' Its primary purpose seems to be screen captures and webcam access, making it a classic espionage tool. Somewhat surprisingly the code uses antique system calls. 'These are some truly ancient functions, as far as the tech world is concerned, dating back to pre-OS X days,' he wrote in the blog post. 'In addition, the binary also includes the open source libjpeg code, which was last updated in 1998.' The script also contains Linux shell commands. Running the malware on a Linux machine, Malwarebytes 'found that -- with the exception of the Mach-O binary -- everything ran just fine.' It is possible that there is a specific Linux variant of the malware in existence -- but the researchers have not been able to find one. It did find two Windows executable files, courtesy of VirusTotal, that communicated with the same CC server. One of them even used the same libjpeg library, which hasn't been updated since 1998, as that used by Quimitchin."
Seriously?
'Security researchers have a uncovered a Mac OS based espionage malware they have named "Quimitchin." .. an IT admin noticed unusual traffic coming from a particular Mac, and has been seen infecting Macs at biomedical facilities.'
How exactly does the malware get onto the Mac without the end user downloading and installing the malware and providing it with the admin password?
This 'security researcher' may be surprised to find that most of the software he uses on a Mac calls some 'antique system calls' that existed before OSX.
"First they came for the slanderers and i said nothing."
Somewhat surprisingly the code uses antique system calls. 'These are some truly ancient functions, as far as the tech world is concerned, dating back to pre-OS X days,'
Kinda sounds like it's using POSIX functions which would be a smart move because they will not be removed in favor of a new API and it makes porting to other platforms easier since most everything is at least partly compliant to POSIX. Perl and Java were good choice since they are on all Apple machines and are resistant to library compatibility issues. This seems like it's a nation-state attack.
Anons need not reply. Questions end with a question mark.
Brought to you by the department of redundancy department.
You have to be kidding me. Is this how MacOS is shipped?
MacOSX ... and now a varient on Linux?!@ Complete absurd.
Only WIndows sucks and gets viruses and malware because it is not bless by RMS nor open sourced. You can run things under root for all your mission critical needs with no firewall at all for Apple products and be perfectly safe. Just ask any Apple fanboy and they will tell you or go on slashdot and ask anyone about security on Linux. It is impossible to get malware.
THe author MOST WORK FOR MICROSOFT
http://saveie6.com/
There have been a string of 'security researchers' being featured here on /. lately that are simply trying to get some limelight just by claiming the perpetrator being the boogeyman-du-jour, actually the same 'security researcher' wrote about a variation of this a few months ago: https://blog.malwarebytes.com/...
- You need to download it
- You need to run it (with various warnings being thrown up)
- You need to install Java for it to run (which does not come standard on a Mac, requires a significant download and few actually need for anything anymore)
This seems to be just a variation of the Tibet, Flashback and Adwind (dating from 2012), which all drop a small Java program as a payload which does screenshots, webcamming, remote control and/or ad proxy and dials back to a C&C server. I discovered a variant a few weeks ago that would generate random dictionary names for it's plists but it functions just the same as these.
Custom electronics and digital signage for your business: www.evcircuits.com
So can the security researcher do the planet some good by providing a simple Java app which would clean everything or do we really need to buy Malwarebytes to fix this? Java was marketed as "write once run everywhere" after all.
That's okay - I've got karma to burn, and if M$ shills choose to employ Trumpian tactics, well . . . they should go after someone with serious complaints instead of a bunch of comedians like us. Now I know how Alec Baldwin and the cast of SNL feel. It's good to know that we engendered such a response in one of Redmond's minions. Next, we'll be hearing how this could be fixed by not relying on name services for host resolution - after all there's got to be a better way.
(Waiting for my pet troll to answer, assuming he still has an internet connection)