Slashdot Mirror
Malwarebytes Discovers 'First Mac Malware of 2017' (securityweek.com)
wiredmikey writes: Security researchers have a uncovered a Mac OS based espionage malware they have named "Quimitchin." The malware is what they consider to be "the first Mac malware of 2017," which appears to be a classic espionage tool. While it has some old code and appears to have existed undetected for some time, it works. It was discovered when an IT admin noticed unusual traffic coming from a particular Mac, and has been seen infecting Macs at biomedical facilities. From SecurityWeek.com: "Quimitchin comprises just two files: a .plist file that simply keeps the .client running at all times, and the .client file containing the payload. The latter is a 'minified and obfuscated' perl script that is more novel in design. It combines three components, Thomas Reed, director of Mac offerings at Malwarebytes and author of the blog post told SecurityWeek: 'a Mac binary, another perl script and a Java class tacked on at the end in the __DATA__ section of the main perl script. The script extracts these, writes them to /tmp/ and executes them.' Its primary purpose seems to be screen captures and webcam access, making it a classic espionage tool. Somewhat surprisingly the code uses antique system calls. 'These are some truly ancient functions, as far as the tech world is concerned, dating back to pre-OS X days,' he wrote in the blog post. 'In addition, the binary also includes the open source libjpeg code, which was last updated in 1998.' The script also contains Linux shell commands. Running the malware on a Linux machine, Malwarebytes 'found that -- with the exception of the Mach-O binary -- everything ran just fine.' It is possible that there is a specific Linux variant of the malware in existence -- but the researchers have not been able to find one. It did find two Windows executable files, courtesy of VirusTotal, that communicated with the same CC server. One of them even used the same libjpeg library, which hasn't been updated since 1998, as that used by Quimitchin."
Seriously?
'Security researchers have a uncovered a Mac OS based espionage malware they have named "Quimitchin." .. an IT admin noticed unusual traffic coming from a particular Mac, and has been seen infecting Macs at biomedical facilities.'
How exactly does the malware get onto the Mac without the end user downloading and installing the malware and providing it with the admin password?
This 'security researcher' may be surprised to find that most of the software he uses on a Mac calls some 'antique system calls' that existed before OSX.
"First they came for the slanderers and i said nothing."
Somewhat surprisingly the code uses antique system calls. 'These are some truly ancient functions, as far as the tech world is concerned, dating back to pre-OS X days,'
Kinda sounds like it's using POSIX functions which would be a smart move because they will not be removed in favor of a new API and it makes porting to other platforms easier since most everything is at least partly compliant to POSIX. Perl and Java were good choice since they are on all Apple machines and are resistant to library compatibility issues. This seems like it's a nation-state attack.
Anons need not reply. Questions end with a question mark.
Brought to you by the department of redundancy department.
Yes, OSX has an executable /tmp by default.
I just checked.
"First they came for the slanderers and i said nothing."
If the author worked for Microsoft, the exploit would require frequent updates, half of which would break it.
Are you seriously trying to claim that he is some sort of alarmist? From the link that you provided, it concludes:
And where did the blogger claim the perpetrator of this malware was the boogeyman-du-jour? All I could find was things like:
That doesn't paint the picture of an uber-hacker! At no point was it claimed that this was going to affect us all. In fact, it was said that this has already been fixed by Apple:
If he is trying to "get some limelight" then aren't you also doing the same thing by posting here? Just talking about something is not the same as getting some limelight. This was just another post about the latest malware to be investigated by them. At no point was it hyped as anything new. It discussed the parts of the malware that seemed to be ancient code, as well as the parts that were new. However, I will admit that the headline of "the first Mac malware of 2017" is pretty inflammatory considering that it seems to have been deployed for a while. I think it would have been better said as the first malware of 2017 that he had looked at.
This quote from the article:
There have been a number of stories over the past few years about Chinese and Russian hackers targeting and stealing US and European scientific research. Although there is no evidence at this point linking this malware to a specific group, the fact that it's been seen specifically at biomedical research institutions certainly seems like it could be the result of exactly that kind of espionage.
seems pretty alarmist to me.
Custom electronics and digital signage for your business: www.evcircuits.com
Why? In what way does it seem implausible? If this malware has only been seen at a certain type of place, what other conclusion is more likely to you? That it is all some giant coincidence and that we should pay no attention to where it was found?
Surely the alarmist thing would be to say that everybody is likely to be attacked by this malware. Or maybe that it was a terrorist plot to release some biological agent into the atmosphere by remote control. But no, it just says that it is probably just everyday industrial espionage with no suggestion of a further agenda. That is not alarmism. In fact, the take home message that I got from the article is that I don't have to worry about my system being infected with this malware; now or in the future. The only reason why it was even reported here was that it was the first malware that he has examined for the year. Considering how old it appears to be, it's not even being portrayed as if it was the first that was written this year.
So can the security researcher do the planet some good by providing a simple Java app which would clean everything or do we really need to buy Malwarebytes to fix this?
RTFM helps. “Apple calls it 'Fruitfly', and has already released an update that will be automatically downloaded behind the scenes to protect against future infections.”
RTFA. Bah.