Malware

87 'Malware' stories May 2011 - May 2017

See All Stories

Comment: The WannaCry attack should be a wake-up call for consumers, businesses and governments

Ben Lovejoy May 15 2017 - 5:12 am PT

The WannaCry ransomware attack may have been exploiting a vulnerability in Windows, but the lesson it provides – the importance of keeping both computers and mobile devices updated – is one applicable to all of us, Apple users included.

WannaCry itself targeted a vulnerability that had existed in Windows all the way through from XP to the latest Windows 10. Microsoft issued a patch to fix the issue for Windows Vista onwards back in March, but many organizations failed to update.

The scale of the attack – which caused widespread disruption around the world – should be a wake-up call to consumers, businesses and governments alike …

Expand
Expanding
Close

Windows backdoor malware disguises itself as Adobe Flash on macOS

Greg Barbosa May 5 2017 - 7:01 am PT

Snake Adobe Flash Player malware on macOS

A new piece of backdoor malware originally discovered on Windows has found a new home in macOS. Disguising itself as a legitimate Adobe Flash Player installer, the malware burrows into pre-existing macOS folders making it harder to spot. Having used a valid developer’s certificate, the malware was set to run free on macOS even with Gatekeeper enabled.

These certificates were created to help validate applications with Gatekeeper, but lately have been used to spread malicious software. This is the second reported malware incident in the past week using a valid certificate.

Expand
Expanding
Close

Nasty Mac malware bypasses Gatekeeper, undetectable by most antivirus apps

Ben Lovejoy Apr 28 2017 - 5:17 am PT

We learned recently that macOS malware grew by 744% last year, though most of it fell into the less-worrying category of adware. However, a newly-discovered piece of malware (via Reddit) falls into the ‘seriously nasty’ category – able to spy on all your Internet usage, including use of secure websites.

Security researchers at CheckPoint found something they’ve labelled OSX/Dok, which manages to go undetected by Gatekeeper and stops users doing anything on their Mac until they accept a fake OS X update …

Expand
Expanding
Close

Mac
Malware

Mac malware grew 744% in 2016, says McAfee report, but most of it is adware

Ben Lovejoy Apr 6 2017 - 4:15 am PT

The latest McAfee Threat Report shows that macOS malware grew by 744% in 2016, with around 460,000 instances detected. Behind the headline number, though, are a couple of reassuring facts.

First, while Mac malware is on the increase, it is almost a rounding error when viewed alongside Windows malware. All malware detected last year combined totalled more than 600M instances. Of this, around 15M examples were mobile malware – almost all of it Android …

Expand
Expanding
Close

Malwarebytes discovers new ‘Fruitfly’ malware running antiquated code on macOS

Greg Barbosa Jan 18 2017 - 7:32 am PT

The team over at Malwarebytes has recently discovered what they’re calling “the first Mac malware of 2017”. The Fruitfly malware has been using antiquated code to help it run undetected for quite some time on macOS systems. It has reportedly been used in targeted attacks at biomedical research institutions.

Expand
Expanding
Close

This month’s critical Flash vulnerability gives attackers control of a Mac …

Ben Lovejoy Oct 12 2016 - 7:09 am PT

We’re honestly running out of headlines for these things. In what has now become a routine announcement, Adobe has admitted that yet another critical vulnerability could allow an attacker to take complete control of a Mac, Windows, Linux or ChromeOS machine.

Expand
Expanding
Close

Comment: The Catch-22 position Apple is in regarding the iOS 9.3.5 security fix

Ben Lovejoy Aug 26 2016 - 7:26 am PT

One of the major benefits of Apple’s ecosystem is that it’s a pretty secure environment. Take OS X (soon to be macOS). The first ever example of OS X ransomware seen in the wild was earlier this year, when it was major news. Other Mac malware exists, but it’s rare enough that individual examples make the news – and most of those require users to do something irresponsible, like install software from an unknown source.

Contrast that with Windows, where the BBC reported that the number of viruses, worms and trojans in circulation topped the one million mark as long ago as 2008. That may be somewhat exaggerated, but most sources agree that the number is in six figures.

iOS is an even more secure platform. Sure, if you jailbreak an iPhone, all bets are off, and there are ways to install sketchy apps on iOS devices using an enterprise certificate. But absent those two things, it wasn’t until this year that the first example of iOS malware was found …

Expand
Expanding
Close

Malware

Malwarebytes reports new OS X malware that could easily fool less technical users

Ben Lovejoy Aug 19 2016 - 6:50 am PT

No 9to5Mac reader is going to be at risk from malware that directs users to a scam website and asks them to download software, but Malwarebytes has discovered a previously unknown piece of Mac malware that could easily fool less technical users.

Thomas Reed, lead researcher at Malwarebytes, told us that he found the malware on a scam page hosted on the official Advanced Mac Cleaner website …

Expand
Expanding
Close

Malware

Stagefright-style vulnerability discovered in OS X and iOS, update for protection

Ben Lovejoy Jul 22 2016 - 4:10 am PT

Security researchers last year discovered what they described as ‘the worst Android vulnerability ever,’ able to infect a phone with malware simply by sending an MMS message to it. The vulnerability, dubbed Stagefright, didn’t even require people to open the message for their phone to be infected.

A Cisco researcher has now discovered a similar vulnerability in OS X and iOS, that could allow an attacker to gain access to your stored passwords and files simply by sending you a malicious image file …

Expand
Expanding
Close

New Mac malware in the wild, Backdoor.MAC.Elanor – can steal data, execute code, control webcam

Ben Lovejoy Jul 6 2016 - 4:00 am PT

After the first ever example of Mac ransomware was found in the wild earlier this year, Bitdefender Labs has found what it tells us is only the second example of true Mac malware to enter circulation this year, which it has dubbed Backdoor.MAC.Elanor. The malware application was available on a number of (formerly?) reputable download sites such as MacUpdate.

The backdoor is embedded into a fake file converter application that is accessible online on reputable sites offering Mac applications and software. The EasyDoc Converter.app poses as a drag-and-drop file converter, but has no real functionality – it simply downloads a malicious script.

This is a nasty backdoor that can steal data, execute remote code and access the webcam, among other things …

Expand
Expanding
Close

Security firm discovers first iOS malware that can infect non-jailbroken iPhones w/o enterprise certificate

Ben Lovejoy Mar 17 2016 - 4:09 am PT

Non-jailbroken iPhones are usually close to immune from malware thanks to Apple vetting every app before it’s made available in the App Store. So far, malware has relied on abusing enterprise certificates designed to allow companies to distribute apps to their own phones. But security company Palo Alto Networks has discovered a new piece of malware that can infect iPhones by exploiting a vulnerability in Apple’s DRM mechanism.

AceDeceiver is the first iOS malware we’ve seen that abuses certain design flaws in Apple’s DRM protection mechanism — namely FairPlay — to install malicious apps on iOS devices regardless of whether they are jailbroken.

AceDeceiver currently uses a geotag so that it is only activated when a user is located in China, but a simple switch could allow it to infect iPhones elsewhere …

Expand
Expanding
Close

Popular Instagram client removed from App Store for harvesting usernames, passwords

Chance Miller Nov 10 2015 - 5:36 pm PT

Apple today has pulled a popular Instagram client from the App Store after it was found to be harvesting usernames and passwords. First noticed by developer David L-R on Twitter, the Instagram client InstaAgent has been pulled from the App Store. The app, downloaded more than half a million times, touted that it would let you see who had been viewing your Instagram profile.

Expand
Expanding
Close

A modified version of XcodeGhost remains a threat as compromised apps found in 210 enterprises

Ben Lovejoy Nov 4 2015 - 6:50 am PT

Security firm FireEye said in a blog post that XcodeGhost – a fake version of Xcode that injected malware into genuine apps – remains a threat. FireEye has identified a more advanced version of the compromised app development tool, XcodeGhost S, which has been designed to infect iOS 9 apps and allow compromised apps to escape detection by Apple.

XcodeGhost is planted in different versions of Xcode, including Xcode 7 (released for iOS 9 development). In the latest version, which we call XcodeGhost S, features have been added to infect iOS 9 and bypass static detection.

We have worked with Apple to have all XcodeGhost and XcodeGhost samples we have detected removed from the App Store.

The company said that by monitoring its customers’ networks, it identified 210 enterprises with infected apps running inside their networks – a third of them in the USA – generating 28,000 attempts to connect to the XcodeGhost Command and Control (CnC) servers …
Expand
Expanding
Close

Security researcher finds simple way to bypass Gatekeeper and allow a Mac to run malware

Ben Lovejoy Sep 30 2015 - 7:16 am PT

A security researcher has found an extremely simple way to bypass Gatekeeper to allow Macs to open any malicious app, even when it is set to open only apps downloaded from the Mac App Store.

Patrick Wardle, director of research at security firm Synack, told arsTechnica that once Gatekeeper okays an approved app, it pays no more attention to what that app does. The approved app can then open malicious apps – which Gatekeeper doesn’t check.

Wardle has found a widely available binary that’s already signed by Apple. Once executed, the file runs a separate app located in the same folder as the first one […] His exploit works by renaming Binary A but otherwise making no other changes to it. [He then] swaps out the legitimate Binary B with a malicious one and bundles it in the same disk image under the same file name. Binary B needs no digital certificate to run, so it can install anything the attacker wants …

Expand
Expanding
Close

Apple names top 25 apps infected by XcodeGhost as most estimates reach four figures

Ben Lovejoy Sep 24 2015 - 4:05 am PT

Apple has named the top 25 apps infected by the XcodeGhost malware, stating that “the number of impacted users drops significantly” for other compromised apps. Most security researchers now agree that the total number of infected apps is in or around four figures, with many of them still present in China’s App Store …
Expand
Expanding
Close

Apple to offer local Xcode downloads in China as scale & scope of XcodeGhost issue becomes clearer

Ben Lovejoy Sep 23 2015 - 4:20 am PT

Apple is to make Xcode available for local download from servers based in China as part of its response to the XcodeGhost malware issue. The announcement was made on the Chinese social media site Sina by Phil Schiller, Apple’s senior VP of worldwide marketing (via CNET). It’s believed that many Chinese developers inadvertently downloaded the fake version because the official download was taking too long.

“In the US it only needs 25 minutes to download,” Schiller told Sina, admitting that in China getting Xcode “may take three times as long.” He told the Chinese publication that, to quell this problem, Apple would be providing an official source for developers in the People’s Republic to download Xcode domestically.

Analysis of infected apps by security researchers appears to be revealing a mix of good and bad news …
Expand
Expanding
Close

Compromised apps remain in Apple China App Store; $1M bounty offered for iOS 9 exploits

Ben Lovejoy Sep 22 2015 - 4:49 am PT

App analytics company SourceDNA – whose clients include Google, Amazon and Dropbox – claims that the compromised versions of many apps remain live in the Chinese App Store. This includes CamCard, which is a very popular app ranked #94.

The apps were infected with malware by a fake version of Xcode dubbed XcodeGhost which legitimate developers were fooled into downloading, believing it to be a copy of the genuine Apple app. A partial list of infected apps has been posted by security company Palo Alto Networks …
Expand
Expanding
Close

Security firm publishes list of some of the iOS apps infected by XcodeGhost – including Angry Birds 2 [Update: more apps]

Ben Lovejoy Sep 21 2015 - 4:06 am PT

Update 1: The list of apps has now been updated with apps identified by Dutch security company Fox-IT. The company is reporting seeing malware traffic from the apps in Europe.

Update 2: Rovio has advised that only the version of Angry Birds 2 in the Chinese App Store was affected.

I wish to clarify that Rovio can confirm that only the Chinese build of Angry Birds 2 — available only on the App Store in Mainland China, Taiwan, Hong Kong and Macau — is vulnerable to the security issue. All other builds of Angry Birds 2 available in other countries are completely safe and secure. An update of Angry Birds 2 for customers in Mainland China, Taiwan, Hong Kong and Macau that fixes the issue is coming very shortly.

After yesterday’s revelation that hundreds of iOS apps on the App Store had been infected by malware, security company Palo Alto Networks has posted a list of some of the affected apps – which include Angry Birds 2.

The apps were infected by a fake copy of Xcode dubbed XcodeGhost, unwittingly downloaded by Chinese developers in place of the real thing. It’s believed they downloaded the fake from local servers because it took too long to download the original from Apple’s own servers. It’s not yet known why Apple’s own checks did not detect the malware when apps were submitted to the App Store.

It’s been suggested that over 300 apps are infected, with 31 of them so far identified (list below) …
Expand
Expanding
Close

iOS jailbreak malware stole 225,000 Apple IDs across 18 countries, but it’s unlikely you’re at risk

Ben Lovejoy Sep 1 2015 - 4:04 am PT

Researchers from Palo Alto Networks have discovered that a piece of iOS malware successfully stole more than 225,000 Apple IDs and passwords from jailbroken phones, using them to make purchases from the official App Store. The malware, dubbed KeyRaider, also has the ability to remotely lock jailbroken iOS devices in order to hold them to ransom.

These two tweaks will hijack app purchase requests, download stolen accounts or purchase receipts from the C2 server, then emulate the iTunes protocol to log in to Apple’s server and purchase apps or other items requested by users. The tweaks have been downloaded over 20,000 times, which suggests around 20,000 users are abusing the 225,000 stolen credentials.

However, it’s extremely unlikely that you’re at risk: the malware can only run on jailbroken devices, and appears to spread through only one set of Cydia repositories, run by Weiphone.

The malware was used in two tweaks that allow those running them to download paid apps and make in-app purchases from Apple’s official App Store without payment. The tweaks used the stolen credentials to make the purchases.

If you think your iPhone or iPad may be at risk, Palo Alto Networks has provided the following instructions to detect and remove the malware. Further details over at the company’s lengthy blog entry.

Users can use the following method to determine by themselves whether their iOS devices was infected:

Install openssh server through Cydia

Connect to the device through SSH

Go to /Library/MobileSubstrate/DynamicLibraries/, and grep for these strings to all files under this directory:

wushidou

gotoip4

bamu

getHanzi

If any dylib file contains any one of these strings, we urge users to delete it and delete the plist file with the same filename, then reboot the device.

We also suggest all affected users change their Apple account password after removing the malware, and enable two-factor verifications for Apple IDs.

The company also notes that not jailbreaking iOS devices is the only way to protect against such exploitation.

Chrome for Mac will soon require Chrome Web Store distribution for extensions to prevent malware

Jordan Kahn May 13 2015 - 9:11 am PT

Back in May of last year, Google started enforcing a policy that requires Chrome extensions be hosted on its Chrome Web Store, but only on Windows. The goal was to prevent malware hidden in extensions installable from outside its store, and it even started disabling extensions already installed on users’ systems that weren’t hosted on the Chrome Web Store. Now, Google says it will bring that requirement to Mac Chrome users over the coming months, as well as the Chrome developer channel for Windows that wasn’t previously enforcing the policy:
Expand
Expanding
Close

Malware hidden in Nvidia GPUs can infect Macs too, say developers behind proof of concept

Ben Lovejoy May 12 2015 - 4:05 am PT

Anonymous developers who have successfully infected Nvidia GPU cards with malware on both Linux and Windows machines say that the same can be done on Macs, and that they will release the proof soon. The aim of the whitehat developers is to raise awareness of this new method of attack, reports IT World.

The team successfully created a piece of malware called WIN_JELLY which acts as a Remote Access Tool, enabling attackers to control a machine over the Internet. They now plan to release a version for OS X called MAC_JELLY, demonstrating that Macs too are vulnerable.

There are, they say, two core problems. First, the growing power of modern GPUs means that it is increasingly common for processing tasks to be passed to them, something that would look legitimate to the OS. Second, most security tools designed to detect malware don’t scan the RAM used by the GPU.

The developers hint that the Mac version of the exploit will use OpenCL, a framework for writing code that can run on multiple platforms – including GPUs – and which is installed as standard as part of OS X.

While Mac and iOS malware is rare, neither platform is immune from attack. Wirelurker was last year found to be capable of infecting non-jailbroken iOS devices when connected to Macs running compromised software, and Flashback infected hundreds of thousands of Macs back in 2012.

Apple recently pulled many antivirus apps from the iOS app store, though this may be because many of them performed no useful function.

Apple reportedly cracks down on antivirus apps from iOS App Store, many apps pulled

Benjamin Mayo Mar 19 2015 - 12:11 pm PT

Searching for ‘antivirus’ now only shows games or Find My iPhone-esque apps.

Apple has seemingly decided to crack down on antivirus and antimalware apps, removing them from the App Store. Although there has been no official statement from Apple on a policy change, Apple’s loose guidelines allow them to pull pretty much anything at any time, particularly something like antivirus which has questionable utility within the sandboxed iOS environment of iPhones and iPads.

One casualty of the removal is Intego’s VirusBarrier, which claims that this takedown was not specific to its product with Apple deciding the entire category of antivirus products is now off-limits.

Expand
Expanding
Close

Grab this (Typinator, Intensify Pro, Paperless, Pixa, MacJournal, more!) Mac Bundle while it is only a buck or 2

Seth Weintraub Nov 25 2014 - 9:00 pm PT

From 9to5Toys.com:

We’ve got a nice 9to5Toys Specials deal on this evening and the best part is that it is a name your own price with the bids starting at $1. The earlier you get in, the less you pay. Here’s the list of apps but frankly Typinator alone is worth it. Go big and 10% of your purchase price goes to a charity of your choice and you’ll be entered to win a Gold iPad 2 & iPhone 6

(Update:6:30am ET: the price is now $3.50)

Typinator – $32 – The program the “types” frequently used text for you
Hotspot Shield VPN – 1 Year Elite Subscription
Starry Night Enthusiast – $80 – Turn your computer into a virtual universe
Intensify Pro – $60 – The image enhancer for photographers of all levels
Spotdox 3 – $72 – Get access to all your files, on any device, anywhere
Data Backup 3 – $49 – Easy, powerful, and flexible backups
Paperless – $50 – Fuel your paper-free lifestyle
MacJournal 6 – $40 – Multimedia journal for the 21st century
Pixa – $25 – Image management and sharing app
Must Have Mac App Tutorial – $100 – Learn how to maximize the 9 apps included

Chinese Mac and iOS users targeted by new ‘WireLurker’ malware capable of infecting non-jailbroken devices

Mike Beasley Nov 5 2014 - 4:25 pm PT

Update: Apple confirmed the security issue in a statement provided to iMore. Apple has also revoked the certificate to prevent the apps from being installed on new devices.

The New York Times reports that a security firm called Palo Alto Networks has uncovered a new form of Apple-focused malware that is capable of infecting non-jailbroken iOS devices. Typically when such software pops up, as it does from time to time, one of the key factors that allows the malicious code to run on iOS is whether the device is jailbroken. The new “WireLurker” malware, however, is installed on the mobile device over USB by an infected Mac.

These infected Mac apps are reportedly coming from the Maiyadi App Store, a third-party software storefront operated in China. Palo Alto Networks says over 400 apps in the store are affected, and have been downloaded over 356,000 times total, potentially resulting in hundreds of thousands of infected devices.

Expand
Expanding
Close