Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Digita Security
Part III: Burned by Fire(fox)
This is Part 3 of a 3 Part series. In Part 1, we identified the malware as OSX.Netwire.A and discussed the infection vectors of the attack. In Part 2, we detailed the malwareâs methods of persistence, and fully reversed the sample to uncover its remotely taskable capabilities. In this next section we will review the second specimen which persists within the attack and creates an additional backdoor.
Digita Security Blog
Sign up with your email address to receive news, updates, and promotional offers as we work toward our product release. â â â â â â Cybersecurity solutions for the macOS workforce June 23, 2019 Part III: Burned by Fire(fox) Recently, an attacker targeted (Mac) users via a Firefox 0day.
Part II: Burned by Fire(fox)
This is Part 2 of a 3 Part series. In Part 1, we identified the malware as OSX.Netwire.A and discussed the infection vectors of the attack. As a recap, Digita’s EDR solution, GamePlan, would’ve been able to leverage its behavioral analytics to detect many undesirable events which OSX.Netwire.A creates while attempting to execute its attack.
Burned by Fire(fox)
At Digita, we don’t rely on known malware signatures in order to detect malicious behavior. To limit the impact of 0days, we provide consistent defense for the enterprise even as the anatomy of malware evolves. Digita’s enterprise security offering, GamePlan, leverages an advanced library of behavioral heuristics and Apple’s game engine to create a powerful platform that translates malware research into the detection of attacker techniques.
Digita Security Training
Sign up with your email address to receive news, updates, and promotional offers as we work toward our product release. â â â â â â
UXProtect
Sign up with your email address to receive news, updates, and promotional offers as we work toward our product release. â â â â â â
Mac Adware, a la Python
Background Chances are, if an Apple user tells you their Mac is infected, it’s likely adware. Over the years, Mac adware has become ever more prolific as hackers seeks to financially “benefit” from the popularity of Cupertino’s devices. 📝 👾 Want to play along? Iâve uploaded the samples discussed in this post. Downloads them here (password: infect3d).
Middle East Cyber-Espionage (part 2)
Background A few weeks ago, I posted part one of this two-part blog series covering the macOS exploits and implants used in a Middle East cyber-espionage operation. Today, we’ll complete the analysis of OSX.WindTail, detailing it’s installer and self-delete logic, and thru reverse-engineering uncover it’s main capabilities. In that previous post we covered: the exploitation vector (custom URL schemes).
The Mac Malware of 2018
Background Hooray, it’s the New Year! 2019 is going to be incredible, right? …right? For the third year in a row, I’ve decided to post a blog that comprehensively covers all the new Mac malware that appeared during the course of the year. While the specimens may have been briefly reported on before (i.e. by the AV company that discovered them), this blog aims to cumulatively cover all new Mac malware of 2018 - in one place.
Remote Mac Exploitation Via Custom URL Schemes
In recent blog posts we’ve discussed vulnerabilities or flaws in macOS that allow malicious code to perform all sorts of nefarious actions such as: bypassing SIP, approving kernel extensions, dumping the keychain and much much more! However, exploiting these flaws all require that the malicious code has (somehow) already gained initial code-execution on the targeted system. In other words they are local attacks, which generally would be used in the 2nd-stage of an offensive cyber operation.
Synthetic Reality
Imagine you’re an attacker (or piece of malware) that’s successfully just gained access to a Mac. Hooray! You probably want to do things like: Unfortunately (for you, the attacker) on recent versions of macOS, a handful of new security mechanisms prevent these actions. Now, these security mechanisms will all generate alerts in response to such actions.
Do Not Disturb
Do Not Disturb is built for the mobile workforce. Do Not Disturb runs software on your MacBook so that protections follow your computer everywhere. After receiving an alert you can remotely control your laptop from the iPhone application to take a picture using the MacBook camera or initiate a hard shutdown to trigger enabled FileVault disk encryption. Do Not Disturb easily integrates with your enterprise. Devices are centrally managed by an enterprise specific Certificate Authority.
Do Not Disturb
Do Not Disturb alerts you to potential ‘Evil Maid’ attacks by notifying you of attempts to gain physical access your MacBook, perhaps without your consent or knowledge. The Do Not Disturb macOS app (DND macOS) continually monitors your laptop for lid open events, as a precursor to these “Evil Maid” attacks. If you’ve triggered sleep mode by closing your laptop lid, the majority of physical access attacks likely require the lid to be opened in order for the attack to succeed.
Tearing Apart the Undetected (OSX)Coldroot RAT
Patrick has always said he likes his tools open source! Follow along as he uncovers and analyzes an undetected cross-platform “Remote Administration Tool”, complete with tracing its origins to a github repository and a publicly available YouTube demo 𘮠Want to interactively play along with his breakdown? Objective-See has shared the malware, which can be downloaded here – password: infect3d. Next month, I’m stoked to be presenting some new research at SyScan360 in Singapore.
Analyzing OSX/CreativeUpdater
More macOS malware! Once again tricking users into installing an infected application by leveraging a popular download site to gain trust. Read Patrick’s short blog post as he dissects the persistence mechanism for this cryptomining malware targeting macOS users. Want to interactively play along with his breakdown? Objective-See has shared the malware, which can be downloaded here – password: infect3d. We’re barely into 2018, and already there is another Mac trojan going around.
UXProtect
UXProtect allows a user to explore the features and rules utilized by macOS’s XProtect. Notable features of UXProtect include: To begin using UXProtect first download the zip archive containing the application. Depending on your browser, you may need to manually unzip the application by double-clicking on the zipped archive. Optionally, drag and drop the extracted application to the location of your choosing (typically the Applications folder).
Analyzing CrossRAT
Follow along with Patrick at 40,000ft as he dives deeper into the capabilities of macOS malware first reported by Lookout/EFF in their Dark Caracul analysis. Want to interactively play along with his breakdown? Objective-See has shared the malware, which can be downloaded here – password: infect3d. I’m on a plane again…this time flying home from one of my favorite hacker cons: ShmooCon! I was stoked to give a talk about auditing on macOS.
Patrick Wardle Joins the Digita Family!
Patrick is widely regarded as a top researcher in the fields of macOS security and malware analysis. He has been credited with numerous CVEs in core macOS components. Their subsequent fixes have improved macOS security for every user and have been rumored to have spawned a new phrase in Cupertino, “Getting Wardled”. This year Patrick’s research has been featured on CNN, Forbes, and the New York Times.
High Sierra installer reverts XProtect rules
October 19th, 2017 Update: Apple has just silently pushed an updated XProtect configuration package that appears to address this issue. The package changes the receipt identifier that was the root cause of the problem. It does not change the configuration version number nor introduce any changes to XProtect rules. We’ve confirmed that previously ‘stuck’ machines are now updating properly. TLDR; High Sierra installer replaces XProtect config version 2095 with version 2094.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Digita
Contact Digita, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack