Slashdot Mirror
Mysterious Mac Malware Has Infected Hundreds of Victims For Years (vice.com)
An anonymous reader shares a report: A mysterious piece of malware has been infecting hundreds of Mac computers for years -- and no one noticed until a few months ago. The malware is called "FruitFly," and one of its variants, "FruitFly 2" has infected at least 400 victims over the years. FruitFly 2 is intriguing and mysterious: its goals, who's behind it, and how it infects victims, are all unknown. Earlier this year, an ex-NSA hacker started looking into a piece of malware he described to me as "unique" and "intriguing." It was a slightly different strain of a malware discovered on four computers earlier this year by security firm Malwarebytes, known as "FruitFly." This first strain had researchers scratching their heads. On the surface, the malware seemed "simplistic." It was programmed mainly to surreptitiously monitor victims through their webcams, capture their screens, and log keystrokes. But, strangely, it went undetected since at least 2015. There was no indication of who could be behind it, and it contained "ancient" functions and "rudimentary" remote control capabilities, Malwarebytes's Thomas Reed wrote at the time.
Because Mac users are fruits
"I got [insert anti-virus here] and it has never found anything on [linux;mac os;*nix]?
And you want to argue why they are wrong and when you do, it goes over their heads.
first p0st
Macs aren't so virus proof after all
More Window$ PCs were infected by malware while reading this post.
iLluminati
I think Mac users stopped saying the Mac was immune about 10 years ago. My take on it is that out of the two major desktop options, Windows and Mac, the Mac is the safer bet. As is iOS over Android.
Linux isn't an option for me or most users on the desktop. Too complicated for average users, and for those who rely on creative apps no real options. (please don't tell me about open source alternatives to Photoshop, ProTools etc, they aren't as good. Apple products are not bullet proof, but I still believe for the average user and creative types they are the best option security wise.
Be kind, for everyone you meet is fighting a difficult battle. - Plato
Shouldda got Windows (*slap* *slap* *slap*...)
Table-ized A.I.
Everybody knows Macs are impervious to malware. No Apple product has ever had any malware on it, ever.
Did I mention "ever"?
Now we have the answer: 400.
Also, shouldn't there be someone here talking about how Macs are better than PCs because Macs don't have viruses?
With the very low number of infections and the monitoring of the user through like the webcam, I would think this is a case where looking at the owners of the infected Macs would yield a lot more information about the author and its purpose.
I wouldn't be surprised if this was on the Macs of individuals who have had issues with stalkers in the past.
Mimetics Inc. Twitter
If it's MALware, doesn't it have to do something MALicious? I can't see what this stuff does that is bad. It just sits around watching what you do and doesn't bother you. Nobody even noticed it for years. I think it should be called PALware, like some guy who comes over and sits in your garage and watches while you work on your car. A real PAL. And it doesn't even drink your beer.
I feel like someone who used to work for Apple decidedly to exploit some bug he ran into while coding. How would it get pushed out? 400 users, and the servers weren't active today. A particular website that installs it? A particular update on some standard Mac program? Was he just looking to spy on a few people, got bored or scared and turned it all off?
It makes for a good mystery story. I hate not knowing the answer.
It was written in Perl. Perhaps some Perl regex has become self-aware.
Custom electronics and digital signage for your business: www.evcircuits.com
I'm a long-time Mac-user and Apple fan in general -- and while I feel far more confident when using MacOS than when using Windows, I also feel that it is folly to try to convince anyone that Macs are somehow immune to computer viruses. The way I see it, you have to be realistic and recognize that your own personal vulnerability to hacking efforts is dependent upon a great number of factors. In fact, just like any other crime, the most obvious factors to consider are means, motive and opportunity.
Means could perhaps refer to vulnerabilities. Everyone knows that Microsoft's code sucks -- but let's be frank: Apple releases security patches, too. Therefore, there have been security vulnerabilities in their code. Therefore, human nature being what it is, it is extremely likely that there are still security vulnerabilities in their code. It may sound an awful lot like a logical fallacy, but anyone who really knows computers will tell you that this is almost certainly true, nonetheless.
Motive is most often addressed by Mac advocates (and PC advocates alike, for that matter) who trumpet Apple's small market share as a reason for ignoring the platform. The thing is, Apple's market share figures do not by any stretch of the imagination convey the shear raw number of Mac users; believe it or not, there are somewhere around 100 million Mac users, according to recent figures from Apple. That's not such a small target, if you think about it. But perhaps more intriguing than that, is the finicky nature of this so-called "security through obscurity" argument... because it's not exactly universally true; that is to say, it's only valid until someone interesting to a hacker starts using the platform in question. At that point, the return-on-investment isn't so much a question of how many people they can scoop up in their net... so long as they successfully scoop up the intended target.
And finally, opportunity: We could interpret this as the "human" element, or simply the question of how many Mac users happened to commit the specific type of opsec failure, which causes them to fall into whatever trap had been laid. The small infection rate could suggest that the window of opportunity was small, for some reason; perhaps the nefarious entity who laid the trap was just messing around for a little while, or perhaps (as implied above) they caught up their intended target in the trap, and promptly pulled down their trap to minimize further chances of discovery, and prolong access to the intended target. (Looking at the facts of the case, it might be reasonable to state that they quite succeeded in this goal!)
So regardless of your preferred platform -- this means you too, *nix users -- never, ever assume that your favorite platform is absolutely perfectly secure. Unless it's disconnected from the network entirely. And disconnected from power. And sealed in a locked safe. At the bottom of the ocean. With explosive booby traps. Surrounded by trained sharks with fricken lasers mounted on their heads.
And... well... probably not even then.
This was discovered in January and is likely a variant of Backdoor.OSX.Mokes which was discovered years prior. Nothing new, just anti-virus vendors trying to make a buck off of FUD that headline desperate fake news outlets are desparate to publish to get eyeballs on their advertising.
Which is pretty much every single Apple Mac user out there.
With a long history, a very small number of infected machines, and no active exploitation, I'd guess it's something someone was playing with that he's abandoned long ago or which "escaped from the lab" but didn't get far.
One of the hazards of self-propagatng code is that it does so on its own. So if, while under development, it finds a net connection to a set of vulnerable machines, it's out and spreading. Like before the command-and-control is debugged and/or the payload is ready to do its dirty work. (Thus it may be much nastier than the author(s) inteded.)
If it's GOOD at spreading it quickly saturates the vulnerable population and comes to the attention of users and security experts. If it's BAD at spreading its escape might not be noticed by the author at all - or by anyone else for years, if at all.
400 machines and a decade before it's noticed seems about right.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
So the people who got infected are those who:
- intentionally downloaded malware in spite of a warning from a security product
- gave an exception to said malware. At least twice
- then opted-in to the malware
This would seem to be some sort of popularity scheme article
If an infection with "a few hundred" cases is the best example of Mac malware that Malwarebytes can provide, it is hardly a ringing endorsement for putting their product on my machine.
With so few examples in the wild, my guess is that FruitFly piggybacked onto one of those fake Flash installers that you run into on some of the sketchier websites, or else was installed by a "Mac support specialist" at some Indian call center (yes, there are also websites that target Mac users with the same bogus "Your computer has a virus! Call this number for help!" messages).
Given that some Mac anti-virus vendors have flagged open source software such as wacaw and Platypus as "malware", I'm skeptical in the extreme about hysterical claims concerning evil malware infections running rampant in the MacOS ecosystem. Run a good ad-blocker instead, and you'll eliminate the attack vector for 99.99% of this crap.
Ha ha ha ha ha ha ha ! :-)
Thanks for the laugh, chum. You obviously haven't used any version of Linux for YEARS.
His satisfaction is quite irrelevant. Unless you believe that Any True Scotsman would faff around indefinitely to shave one more nickle off the purchase price.
What matters here is his prospective utility: his net upside after the huge investment to research the alternatives, reinvent his established workflow, learn about all the new nits and gremlins, flawlessly administrate his custom stack of validated alternatives, resolving interoperability difficulties with his contacts and clients, etc. etc.
About 10% of all open source zealots really ought to check themselves into Faffaholics Anonymous.
This code is in C, who the hell uses C anymore must be so ancient.
They are trying to get photos of girls undressing and seeing their private parts as well.
Why did the summary read like a description of discovery of some endangered species?
Only 400 in the wild! So, shall we start some breeding program to preserve it?
The whole world must be ending.
Isnt that kind of the point for malware? Harder to detect?