Mysterious Mac Malware Has Infected Victims for Years

https://motherboard.vice.com/en_us/article/zmv79w/mysterious-mac-malware-has-infected-hundreds-of-victims-for-years

by kawera • 9 years ago

235 135 9 years ago

motherboard.vice.com

tyingq• 9 years ago

"It was also written in Perl, a language that's "archaic" for malware"

Perhaps why it's good at running under the radar.

wil4212• 9 years ago

Sounds like a disgruntled sys admin.

deckar01• 9 years ago

I think the main reason it was running under the radar is that the script itself did not contain an exploit that bypassed any security mechanisms. The only difference between a remote desktop app and a new command and control malware is the way it is installed.

It is not all that surprising to me that any targeted malware could operate unnoticed for years. The odds of discovery are directly proportional to the volume of distribution and inversely proportional to the importance of the targets. This malware apparently infected a small number of low profile targets.

matheweis• 9 years ago

It's not just perl; the screen capture code apparently references GWorlds, something I frankly have not seen since writing software in the 1990's for pre OS X APIs. It's so old that Googling for gworld hardly has any relevant results.

Most of the sample code for those APIs was deprecated by the mid 2000's

Unless the attacker had some unique reason for using that, which seems unlikely, that really does put the code at about 10 years old or so...

reaperducer• 9 years ago

Gonna need it from a source better than Vice.

brian_herman2• 9 years ago

https://www.forbes.com/sites/thomasbrewster/2017/07/24/apple...

rconti• 9 years ago

The Vice article seems much better, and I'm not sure Forbes is a more reliable news source, but the corroboration is of course great.

Sounds like we'll be hearing more after BlackHat. Wish I wasn't skipping this year.

Grazester• 9 years ago

Forbes, the site that served malware in their ads(you can't view their page with an adblocker on either).

danso• 9 years ago

The OP's author, Lorenzo Franceschi-Bicchierai, has always felt like a reliable reporter of this kind of topic, as far as mainstream reporters go: https://motherboard.vice.com/en_us/contributor/lorenzo-franc...

abakker• 9 years ago

Is this the same thing? https://blog.malwarebytes.com/threat-analysis/2017/01/new-ma...

It looks like this has been updated by Apple already?

SingletonIface• 9 years ago

Taking control of a command and control server, however, had another unexpected outcome: Around 400 victims infected with FruitFly started connecting to it.

"Unexpected"? How? This would have been obvious to Wardle. Maybe the journalist added this to "inject some suspense"? Thanks but no thanks, I won't bother reading the rest of this article.

nerdponx• 9 years ago

Maybe he wasn't expecting to see 400 infected victims.

shepard• 9 years ago

Does anyone know of a good way to check whether my Mac is infected with this (or any other) malware programs? I rarely, if ever, download unknown programs, and my OS is always up-to-date, but still...

Would appreciate for any pointers.

guessmyname• 9 years ago

Install MalwareBytes — https://www.malwarebytes.com/

scrumper• 9 years ago

Is this bad advice? Wondering why it's getting voted down. Malwarebytes discovered the issue after all; they're not disreputable.

JadeNB• 9 years ago

If abakker's comment https://news.ycombinator.com/item?id=14840063 is the same issue, then it sounds like you just need to look for `~/.client` and `~/Library/LaunchAgents/com.client.client.plist`.

unpythonic• 9 years ago

The details for the infection can be found at Malwarebytes, the discoverer of this issue:

https://blog.malwarebytes.com/threat-analysis/2017/01/new-ma...

This article has the signature of the infection as well as listing the servers with which it communicates.

intoverflow2• 9 years ago

Someone correct me if I'm wrong but this seems to be talking about FruitFly 1 [1] and the article is about FruitFly 2 [2]. Been digging around and still can't find any description of how to tell if you're infected by the new one.

[1] https://www.virustotal.com/en/file/ce07d208a2d89b4e0134f5282...

[2] https://www.virustotal.com/en/file/befa9bfe488244c64db096522...

epistasis2• 9 years ago

the widespread belief that they are virus-free, Macs aren't immune from invasive and dangerous malware.

This is an area where it's really hard to extrapolate from my personal experience to the entire population, but is this really an accurate statement of many people's beliefs?

I think what people actually think is that the chances are much lower of encountering malware in the wild on a Mac. In support of that, having an article this long on a single piece of malware that isn't particularly damaging, would indicate that it's not the normal state of affairs in Mac land.

I would similarly expect that the chances of drive-by malware on Linux are tiny, perhaps even less common than on a Mac, and thus it would be newsworthy if there were some widespread (in relative terms) Gnome malware, or similar.

It's one thing to think that it's uncommon, and another to think that it's impossible.

digi_owl• 9 years ago

I think it is a holdover from the early Mac days, where a large part of the base OS was in ROM.

Thus a simple reboot would clear out any infection.

That, and over time the lack of a general market presence, is likely what lead to the belief (never mind that Apple pushed the message with their I'm a Mac ads).

802116• 9 years ago

The early mac days when there was no hard-disk, maybe. But if you inserted another floppy when the virus was in-memory, it would spread!

tedunangst• 9 years ago

It's been a few years, but the "I'm a Mac and I'm a PC" ad series talked up virus immunity quite a bit. I suppose one could argue that "don't get malware" was narrowly accurate in the sense that it wasn't presently happening, but there was a strong suggestion of "can't get malware" too.

coldtea7• 9 years ago

It was presently, and it's easy much happening now either. All these "viruses", or 99% of them, are just trojans.

horsawlarway• 9 years ago

I would say it is accurate. I doubt most users really think it through, and Apple went out of their way to enforce the idea that Macs don't get viruses in their advertising campaigns around 2010 to 2012.

Most users just don't think about it much, and the only exposure they got was ads telling them the thing doesn't get viruses, which Apple finally stopped doing in 2012 after have a very uncomfortable year... https://www.wired.com/2012/06/mac_viruses/

If you're here talking on HN, then yes, you probably fall into the category of folks who properly understand that uncommon != impossible. I sincerely doubt the vast majority of users make that jump.

epistasis2• 9 years ago

From that article:

It may have been technically accurate that Macs don’t get gummed up with PC viruses, but the implication that Apple is virus-free is certainly misleading.

But that "implication" is an assumed implication that I haven't seen play out in my non-tech friends. I always thought that stories like those were just drummed up by anti-virus vendors to make sure that people continue buying their wares.

coldtea7• 9 years ago

I think what people actually think is that the chances are much lower of encountering malware in the wild on a Mac.

Yes -- and what people believe is also true. It's indeed much lower, to the point of being a non-issue almost.

(And it's not due to "lower market share" either. Mac OS 7/8 etc had even lower market share than today's Macs have, and it had tons of viruses).

13of402• 9 years ago

Mac OS 7/8 etc had even lower market share than today's Macs have, and it had tons of viruses

That's not a valid comparison. When Mac OS 7/8 was mainstream, it was common to get software via a floppy disk that had already been in 10 other machines or from a fly-by-night BBS. Nowadays software distribution is far less peer-to-peer, and it's much more difficult for simple viruses to move from machine to machine.

market share

If it's not market share, then what is it? The vast majority of malware attacks happen via social engineering, not zero day vulnerabilities, and the only requirements for that are a gullible user and a computer capable of running unsigned software.

Edit: Since I don't have access to a disposable Mac, just out of curiosity, what happens if you torrent something like "photoshop for mac full edition (cracked)" and try to install it? On a PC, assuming you make it through the hurricane of warnings Windows tries to throw in your way, this will almost certainly result in malware getting installed on your computer. What mechanism prevents this on a Mac?

Semaphor• 9 years ago

My experience with tech illiterate people is that they think they can't get viruses on Mac or iOS. Viruses are a Windows-only thing in their minds.

taurath• 9 years ago

I would guess many 20-somethings have recommended a mac to their parents with this as one of the bullet points. At a time, it was more or less true - when dropping a virus on your windows PC was as easy as loading a malicious activex website, macs just didn't even have it. Not to say macs weren't vulnerable, but the attack surface was lower and the cost/benefit to people trying to bot-net your mom's Mac was higher than everyone's unpatched Compaq running Win98.

valine6• 9 years ago

You can't get viruses on iOS unless you're jailbroken - Apple's walled garden pretty much guarantees that. Even jailbreaking is insanely difficult with the newest versions of iOS. There is no public jailbreak of the current version of iOS, or the version before that.

nihonde• 9 years ago

The flip side of that is supposedly tech literate IT managers who insist that my company implement "industry standard" virus detection software on a fleet of MacBook Pros. The stupid cuts both ways.

NelsonMinar• 9 years ago

People think Macs are virus-free because Apple spent years telling them were. Example ad, with John Hodgman as the Windows guy with a virus. https://www.youtube.com/watch?v=M3Z386vXrt4

threeseed3• 9 years ago

This notion existed far before that ad came out.

It's a combination of a few things: (1) why bother investing time and resources for a platform with around 10% of users and (2) OSX has had strong security mechanisms e.g Gatekeeper, XProtect, App Sandbox. Windows 10 is much better but unfortunately not everyone is on that OS yet.

RandVal30142• 9 years ago

What makes it even worse is they carried this over into a support FAQ stating the OS didn't come with an antivirus because X-security features.

If anyone remembers the vintage of this I'd love to dig an archived copy up.

onion2k2• 9 years ago

Another reason that there may be a perception that OSX is safer these days is that most users only buy software directly from Apple through the app store.

draw_down• 9 years ago

It doesn't matter, tech journos are in love with the narrative of "Mac users think they're better than the rest of us, but they're not!"

pdeuchler2• 9 years ago

Well, what is true is that it's extremely hard to execute arbitrary code without user knowledge on a Mac. Windows has thousands upon thousands of arbitrary code execution bugs where simply opening something like a pdf can allow an attacker to run arbitrary code as a privileged user. There are many defense mechanisms to this that are inherent to the design and implementation of Darwin/Mac OS.

munin2• 9 years ago

There are many defense mechanisms to this that are inherent to the design and implementation of Darwin/Mac OS.

Do you have an example? Beyond the idea of user/root separation, which doesn't really do much for modern single user computers: https://xkcd.com/1200/

dingo_bat• 9 years ago

I don't think that's been true since windows 7. Almost all new viruses rely on user stupidity.

bdcravens• 9 years ago

I suspect if you went into 100 Apple stores, and asked 100 of the bubbly sales persons with their cute little Apple shirts if Macs can get viruses, you'd get 50%+ to say no.

onion2k2• 9 years ago

Don't Apple stores sell Norton Antivirus? If they do I imagine the response would be far less than 50%, but it'd come with a sales pitch.

wnevets• 9 years ago

but is this really an accurate statement of many people's beliefs?

yes. Those on hacker news may understand its not true but non-techies say it all the time ever since apple ran those I'm a pc tv spots

closeparen• 9 years ago

The operative form of this belief is, "you probably shouldn't buy and install a consumer antivirus product for your Mac like you would with a PC" which is probably still true.

zamalek• 9 years ago

many people's beliefs?

Apple marketed it as such even until relatively recently. I've personally heard a few people regurgitate that argument.

It's probably changing because that marketing worked and the platform became more popular: you don't write malware for a platform that nobody uses.

mediocrejoker• 9 years ago

As someone new to the Mac ecosystem, is it standard practice to run an antivirus as it is on Windows?

I have used various Linux systems as my daily web browsing machine for years without feeling the need to install any third-party antivirus.

coldtea7• 9 years ago

As someone new to the Mac ecosystem, is it standard practice to run an antivirus as it is on Windows?

No, almost nobody does it (plus, a few "antivirus" products for Mac are malware themselves, e.g. Mac Defender etc.).

Most so-called "viruses" for Mac are in fact merely trojans (programs you need to download and run yourself to infect you).

pjmlp2• 9 years ago

Corporate laptops everywhere I worked are subject to the same anti-virus policies, regardless of the operating system.

redler• 9 years ago

No. It's unusual. The most common case is Macs in corporate environments where "local anti-virus" is required across all desktop systems (with such policies typically originating in Windows-centric companies).

adrianN• 9 years ago

You probably shouldn't install any antivirus on Windows either. They're so full of holes that they probably increase the likelyhood that you get a virus.

pwython• 9 years ago

I was a Windows user for 10 years. Now a Mac user for 11 years. Haven't needed any sort of antivirus yet. Just thinking back to my time with Windows makes me chuckle, when I had an arsenal of virus scanners, startup disablers, and registry cleaners on hand.

jmull3• 9 years ago

...despite the widespread belief that they are virus-free, Macs aren't immune from invasive and dangerous malware.

I keep hearing this, but I never see evidence of these people. Is there a widespread belief that there's a widespread belief that Macs are immune from malware, despite few people who actually think this?

Well, I'm sure such people exist, but there don't seem to be many, even on sites like macrumors and /r/apple where mostly non-technical people with magical feelings for Apple gather and comment.

kuschku2• 9 years ago

Apple literally had that in their ads.

cmurf• 9 years ago

They still do. https://www.youtube.com/watch?v=dRM31VRNQw0

jmull3• 9 years ago

Yes, but a decade or more ago. The security landscape and perceptions around it have changed.

Also, back then the difference between MacOS and Windows was pretty stark so this was a valid marketing point. Not that the ads didn't oversell it, of course.

tensor• 9 years ago

You need to remember that when those ads aired Windows still ran everything as root and had genuine "viruses", not trojans or other malware. But a virus as in the definition of the term. That Macs and Linux had a sane security model really did make them essentially "immune to viruses" in a very real way.

Today, a genuine virus is a rare thing, most malware are trojans. But back then viruses were the dominant form of malware. It's quite unfair to criticize people claiming Macs don't get "viruses" by changing the context on them to include all malware. That's not the claim people made.

mikejmoffitt2• 9 years ago

In the mid to late 2000s, this was something that was often repeated.

Terribledactyl• 9 years ago

I'd say macrumors and /r/apple are probably a better representation of the general public than other forms of contact you have with people. Realizing that viruses exist escapes some.

Apple even based a commercial on the premise a while back, https://www.youtube.com/watch?v=CHFy6egYcUg

amelius• 9 years ago

By now Windows also has a much stronger security model. So I'd say that the chances of anything happening would theoretically be about equal in Linux, Windows and Mac. But you'd have to take popularity into account, and since the Mac has become more popular, I'd guess they are a victim more often.

gpvos• 9 years ago

As long as Windows still tries to hide file extensions, the rest of its security barely matters. And in what way would its security model be better than MacOS or Linux? I'd say they are about the same nowadays.

JumpCrisscross• 9 years ago

Anecdotally, most non-technical Mac users seem to have better habits than Windows users. Updates get installed and shady software gets loaded up less frequently.

zeta0134• 9 years ago

I worked at a Geek Squad for two years, so definitely take my experience with a grain of salt, but at least in the world of big box retail chains, this was quoted so often by my customers and clients I lost count. Most of my clients that came in with an infection on their Mac (sometimes just a rogue browser extension, but often an honest bit of malware) were genuinely surprised, having purchased the Mac originally because it supposedly didn't have these "Windows" problems.

I suspect this is largely due in part to the types of clients that would actually purchase Geek Squad protection in the first place; my job duties had me working directly with "not computer people" folks most of the time. Still, the idea that Macs were immune to malware was pervasive; on several occasions, folks returned Windows machines they had just purchased (and managed to immediately infect) and picked up a Mac instead, thinking that this act alone would make them immune to their problems, or their kids online behavior, etc. Most folks were good sports about it though, realizing that they had been misled by advertising, and allowing me to explain good security habits to them during their visit.

I think the biggest thing that bothered me about the job, and the reason I eventually left for greener pastures (I presently work in Linux Administration) was the pervasive idea that you could fix computer problems by buying additional software. This is something retailers have latched on to, and it bugs me on a fundamental level. The only way to actually be more secure is to understand your tools, so that you can recognize when they are misbehaving.

watersb• 9 years ago

the biggest thing that bothered me about the job was the pervasive idea that you could fix computer problems by buying additional software

O my god yes. I worked in corporate IT and Management was sold on more complexity all. the. time.

kylehotchkiss• 9 years ago

Given that most people here would be best off not-hacked, what are the best ways (software/security tricks) to avoid malware on OSX?

philfrasty• 9 years ago

BlockBlock is genius for preventing installation of persistent components to the OS.

[1] https://objective-see.com/products/blockblock.html

kccqzy• 9 years ago

I like the concept but I don't like the fact that BlockBlock needs to install a kernel extension. It says it does this to minter process creation. Why can't it do it with dtrace?

Example: https://github.com/kenorb/dtrace-tools#processes

redm• 9 years ago

Linux has a huge advantage in that it has a very wide array of variants, kernels, library configurations through many standard distros and further customizations. It makes it much harder to write distribute complex malware than a standardized OS like Windows.

snarfy• 9 years ago

They were surprised to find malware that wasn't written by a nation-state, which is kind of depressing.

sitkack• 9 years ago

I see no reason to believe it wasn't. Being brutally pedestrian is the kind of thing I would expect out of great hackers.

divanvisagie2• 9 years ago

Also , it may make sense to write malware that looks like it wasn't a nation state if you are a nation state

ecommerceguy• 9 years ago

So, let me get this straight. If I develope malware in an "archaic" language, using "crude code" then I am not a nation-state. "Undetected for years"

Interesting logic. I wonder if the reverse can be said...

If I were a nation state, perhaps I would be taking notes.

joejoebob• 9 years ago

the former spy agency hacker who now develops free security tools

Nice try, NSA.

gaius2• 9 years ago

Missing from the article: how to tell if you have it and what to do if you do

divanvisagie2• 9 years ago

Yeah, I just stuck tape over my camera though.

stereo• 9 years ago

See if you have a ~/.client or a ~/Library/LaunchAgents/com.client.client.plist file.

gaius2• 9 years ago

Thanks for the tip - I'm clean :-)

Mysterious Mac Malware Has Infected Victims for Years

Related Stories