Slashdot Mirror
Sneaky Mac Malware Went Undetected By AV Providers For Four Month (arstechnica.com)
Four months after a mysterious group was outed for a digital espionage operation that used novel techniques to target Mac users, its macOS malware samples continued to go undetected by most antivirus providers, a security researcher reported on Thursday. Ars Technica reports: Windshift is what researchers refer to as an APT -- short for "advanced persistent threat" -- that surveils individuals in the Middle East. The group operated in the shadows for two years until August, when Taha Karim, a researcher at security firm DarkMatter, profiled it at the Hack in the Box conference in Singapore. Slides, a brief description, and a report from Forbes are here, here and here, respectively.
On Thursday, Mac security expert Patrick Wardle published an analysis of Meeting_Agenda.zip, a file Karim had said installed the rare Mac malware. To Wardle's surprise, results from VirusTotal at the time showed that only two antivirus providers -- Kaspersky and ZoneAlarm -- detected the file as malicious. Wardle then used a feature that searched VirusTotal for related malicious files and found four more. Three of them weren't detected by any AV providers, while one was detected by only two providers. The reason the findings were so surprising is that Apple had already revoked the cryptographic certificate the developers used to digitally sign their malware. That meant Apple knew of the malware. In fairness, the control servers the malware contacts are no longer available on the Internet. That means any infected computers aren't in danger of being surveilled. Also in fairness, the number of detections has slowly risen in the day since Wardle published his analysis.
On Thursday, Mac security expert Patrick Wardle published an analysis of Meeting_Agenda.zip, a file Karim had said installed the rare Mac malware. To Wardle's surprise, results from VirusTotal at the time showed that only two antivirus providers -- Kaspersky and ZoneAlarm -- detected the file as malicious. Wardle then used a feature that searched VirusTotal for related malicious files and found four more. Three of them weren't detected by any AV providers, while one was detected by only two providers. The reason the findings were so surprising is that Apple had already revoked the cryptographic certificate the developers used to digitally sign their malware. That meant Apple knew of the malware. In fairness, the control servers the malware contacts are no longer available on the Internet. That means any infected computers aren't in danger of being surveilled. Also in fairness, the number of detections has slowly risen in the day since Wardle published his analysis.
Are they some Apple spin off?
Does this use an exploit, or is it just a trojan.
You can't fix stupid. People will run shit.
Newsflash: AV is pretty useless beyond detecting signatures of KNOWN malware. I've yet to see one that catches, for example, custom PS scripts.
Grammatical error appears on slashdot's front page for more than four minutes.
According to Mac zealots, only Windows machines can get malware or viruses.
You been here four month!
You are a sorry victim of the Mainstream Media Lies.
Thats your "civilization" of fags, highest incarceration rate and casual rape ?
Most likely all of the "malware" is just human engineering. Lots of talk, very little substance in these slides.
Apple always tried to sell itself by saying that they were not having the virus problems that Windows was having. Many countered that Apple was not as popular as Windows and that was the only reason why. They also argued that Apple's days in virus hell were going to eventually arrive, and now they have.
0.0.0.0 string2me.com
0.0.0.0 flux2key.com
* Those are either offline AWAITING to give orders (OR they are denying back ICMPEchoReply (easily settable in IP stack settings)).
You BLOCK those, this thing won't get orders for more havoc it is doubtless out to wreak (couldn't be worse than HAVOC I wreaked on the JACKASS I destroyed here https://it.slashdot.org/commen... & here https://it.slashdot.org/commen... that had to DOWNMOD HIDE those SELF-DEFEATS of his - WHICH WHIPSLASH IN A FIT DELETED, lol!)
SOURCE: https://objective-see.com/blog...
APK
P.S.=> Soon, I'll have a MacOS version of these (completing my multiplatform agenda I had all along):
APK Hosts File Engine 2.0++ 64-bit for Linux h t t p : / / a p k . i t - m a t e . c o . u k / A P K H o s t s F i l e E n g i n e F o r L i n u x . z i p (remove spaces between chars & download)
APK Hosts File Engine 10++ SR-1 32/64-bit for Windows https://hosts-file.net/?s=Down... (DL link @ bottom)