Slashdot Mirror
Shlayer Malware Disables macOS Gatekeeper To Run Unsigned Payloads (bleepingcomputer.com)
A new variant of the multi-stage Shlayer malware known to target macOS users has been observed in the wild, now being capable to escalate privileges using a two-year-old technique and to disable the Gatekeeper protection mechanism to run unsigned second stage payloads. Bleeping Computer reports: This new Shlayer variant unearthed by Carbon Black's Threat Analysis Unit (TAU) targets all macOS releases up to the latest 10.14.3 Mojave, and will arrive on the targets' machines as a DMG, PKG, ISO, or ZIP files, some of them also signed with a valid Apple developer ID to make them look legitimate. Shlayer samples found by TAU also use malicious shell scripts to download additional payloads just like older installments did, and, in the case of samples distributed as DMG images, will surreptitiously launch a .command script in the background after the user launches the fake Flash installer. The malicious script included in the DMG is encoded using base64 and will decrypt a second AES encrypted script which will be executed automatically after being decrypted.
One it successfully downloads the second stage malware payload, Shlayer will "to escalate privileges with sudo using a technique invoking /usr/libexec/security_authtrampoline," presented by Patrick Wardle in his Death by 1000 Installers talk at DEFCON 2017. The next step is to download extra payloads which all contain adware according to TAU and it makes sure they'll be able to run on the compromised Mac by disabling the Gatekeeper protection mechanism. After this is accomplished, all extra payloads downloaded and launched by Shlayer will be seen as whitelisted software because the OS will no longer check if they are signed with an Apple developer ID. Also, just in case the malware is not able to disable Gatekeeper on the infected Mac, some of the second stage payloads are also signed with valid developer IDs.
One it successfully downloads the second stage malware payload, Shlayer will "to escalate privileges with sudo using a technique invoking /usr/libexec/security_authtrampoline," presented by Patrick Wardle in his Death by 1000 Installers talk at DEFCON 2017. The next step is to download extra payloads which all contain adware according to TAU and it makes sure they'll be able to run on the compromised Mac by disabling the Gatekeeper protection mechanism. After this is accomplished, all extra payloads downloaded and launched by Shlayer will be seen as whitelisted software because the OS will no longer check if they are signed with an Apple developer ID. Also, just in case the malware is not able to disable Gatekeeper on the infected Mac, some of the second stage payloads are also signed with valid developer IDs.
So, this would infect people even if Apple fixes the bug right? The fact they can side step checks using signed code is a big deal by itself.
I'm guessing those devel's got cracked, and have some work ahead of them...
The spirit of resistance to government is so valuable on certain occasions that I wish it to be always kept alive
This still requires a user to actively run a process. Hardly the stuff of the windows driveby malware.
Just download this executable to secure your mac: <a href="badguysite.org/install-malware.dmg">Antivirus</a>
Not a virus. Requires you to download and open it. No machine or OS is protected against stupid users.
I don't know what Apple can do about something like this. A valid dev ID can allow software to run as root with full root privs. The only way I can see Apple fixing this is moving the Gatekeeper options to the same place where one sets the T2 boot security via recovery mode, where it is inaccessible in the normal OS.
(IIRC) Ages ago, Sprint required signed code on all their smartphones (this was pre-iPhone, and smartphones were a different type of device than PDA-phones, so they had mainly Windows Mobile offerings.) As a requirement, all code signing keys came on physical smart cards (Aladdin eTokens to be specific.) It was Draconian, but at the time, it did a decent job at ensuring nobody could snatch a developer's key and make off with it. Maybe Apple should have as an option, an Apple HSM (perhaps a rebranded YubiKey HSM) so developers have a physical device that the key never leaves, and a physical button which must be pressed for a signing to actually happen (i.e. a remote attacker will be stuck waiting for the physical YubiKey button press.)
By having the key in a HSM, even without Yubikey's physical authentication, it will ensure that at worst, an attacker has to log on and use the HSM for nefarious reasons, but couldn't grab the key from it.
Except this is an actual software installer. You've got to type your password. It isn't like a .doc vulnerability.
Developer ids and signed software was to provide a level of assurance to the downloader user.
Clearly these developer ids should be invalidated (revoked) in a MacOS update, no?
Where are we going and why are we in a handbasket?
of developer real-world identity (corportate and/or personal) for each developer id.
And a requirement that developers buy into an insurance plan so that if their developer id is used for malware, end-users can file a class-action lawsuit against the developer and recover damages via the insurance pool.
Or better yet, rather than a cumbersome class-action, have a pre-setup mediation service administered by Apple.
Where are we going and why are we in a handbasket?
Gates or Borg" in his parent's basement in Wisconsin.
It's Gates of Borg.. i.e. they are one and the same.
Right as rain as usual APK. So much that the troll morons that stalk you as unidentifiable anonymous and impersonate you are out in force.
People just bypass the sandbox anyway since many freely available packages aren't signed.
APK you really shouldn't talk to your self, especially in the 3rd person. It doesn't make you look mentally stable but then even your regular posts don't make you look mentally stable.
Yeeeees, well, have you read the article in the link? I wonder how many people you deem 'stupid' will follow a Flash player update installer prompt after visiting a website. Probably most. Even you.