Slashdot Mirror
Bugs Allowed Hackers To Make Malware Look Like Apple Software (vice.com)
An anonymous reader shares a report: For years, hackers could hide malware alongside legitimate Apple code and sneak it past several popular third-party security products for Mac computers, according to new research. This is not a flaw in MacOS but an issue in how third-party security tools implemented Apple's APIs. A researcher from security firm Okta found that several security products for Mac -- including Little Snitch, xFence, and Facebook's OSquery -- could be tricked into believing malware was Apple code, and let it past their defenses. "I can take malicious code and make it look like it's signed by Apple," Josh Pitts, the security researcher at Okta who discovered these bugs, told Motherboard. In a blog post published Tuesday, Pitts explained that the issue lies with how the third-party security tools implemented Apple's code-signing APIs when dealing with Mac's executable files known as Universal or Fat files.
We all hate virus scanners, and other security products, because they slow our systems way down, they often will slow our systems more then the actual malware would. However the designers need to find some sweet spot on speed of their tools vs effectiveness of these tools. So flaws like this is understandable, because actually validating the signature will take more time to process vs. the current number of malware that uses this trick.
Now that it is known, I expect security companies will now have to fix their code to check for this, and slow our systems down further. Part of the popularity of these closed ecosystems of iOS vs MacOS is the ability to only allow good actors to work on your platform, while blocking any unknown actors (good or bad) from causing harm, reducing the need for external security software which will slow the system down.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
I had to reinstall iTunes on my Windows 10 PC. I went to the Apple iTunes page and it sent me to... Microsoft App Store. That's right, kiddies. Apple iTunes is now a Windows App. Be afraid... very afraid.
You can also make malware look like microsoft software, but at this point it just seems kind of redundant.
If you talk to creimer people might mod your post down
Just heads up nobody can stand the fucker and mod they down any discussion threads he's part of
Stay with the proven-safe Windows 10! Go forth and multiply, my children! Multiply at every opportunity, my children!
You mean there's a difference????
Nonaggression works!
Security products are bug ridden and bad at the task the purport to do. This is nothing new. As for popular, these products are way over touted. Mac security is not based on the antivirus software you use but rather on fixing the bugs. I have never seen xFence but I have had to remove Little Snitch from a few Mac after it was advertised in the local Catholic church and proceeded to trash each Mac it was installed on. Facebook's product never worked right and I have long and forcefully instructed users to avoid Facebook. They more or less don't listen which is why they still use Facebook to see the ads instructing them to update Flash Player which is not Flash Player but some trojan or another instead. Meh it pays a few bills.
Ah. So that explains iTunes.
Because "hackers"!!!111!elebenty!!1!
that to get an app in to the Apple Store the source/install had to be submitted to Apple for review. So either I am mistaken or Apple is not doing a good job of review. TBH I don't know, I develop In-House apps for clients. And have not tried to use the App Store as a distribution point.
;)
Just my 2 cents
It's possible this particular application is legit, but - why would anyone with any intelligence allow any app from Facebook to have that level of access to their system?
Or have I answered my own question?
#DeleteChrome
Now they have awoken the beast. The legal copyright team of Apple is self aware and ready for its pray.
I feel sorry for the hackers. Smitten like ants under a loop.
Don't fight for your country, if your country does not fight for you.
third party malware vs apples first party malware.
Did the hackers install more CPU throttling code?
Comment removed based on user account deletion
Interesting!
So soon?
The FDA has denied many drug approvals or sent them back to the drawing board on how it is delivered if tests showed that the users could not be counted on to reliably administer them. Difficult to use placement of controls in cars have caused major losses to auto companies on multiple occasions. Usability is an important design feature in many areas of design.
Usability of a security API is a feature that can have bugs. I'm guessing that these tools with bugs were not created by stupid people and they all made the same mistake in implementing their use of this security API.
Why would the security API be outright absolved of fault in this case? Is there not a pattern of error that is likely the result of some design pattern in the API since it is recurring?