Mac malware signed with Apple ID infects activist’s laptop

http://arstechnica.com/security/2013/05/mac-malware-signed-with-apple-id-infects-activists-laptop/

by shawndumas • 13 years ago

125 54 13 years ago

arstechnica.com

sinnerswing• 13 years ago

Not as bad as this

"Android malware attack spreads via e-mail"

http://www.usatoday.com/story/tech/2013/03/28/android-malwar...

http://securitywatch.pcmag.com/mobile-security/311417-window...

myko• 13 years ago

1) What does that have to do with this?

2) FTA:

>Q: What can or should individuals do?

> Stone-Gross: Do not allow installation of applications that are not distributed through the official Google Play marketplace on the device

So this malware isn't effective unless the user explicitly makes their device vulnerable, doing something normally only developers or hard core users - people who are likely to spot this attack - would do.

nicheuser2• 13 years ago

People were saying for years that the superior UNIX design and the bad Windows code is the reason that Windows had a huge malware problem but Linux and Mac did not.

pyre5• 13 years ago

People were mostly talking about drive-by infections and the fact that an unpatched Windows machine idling on the Internet could be infected in an hour or so.

There's nothing anyone can do if a user installs software. UNIX design or not, if the user runs a program, it can access everything that the user can. Nothing that this malware did needed special access (e.g. root exploit).

pflats2• 13 years ago

It was. Windows has since improved its security by a large amount. Windows XP and Windows 7 are two completely different beasts, and even XP is far more hardened than it was at release. (I'm not an expert, but I'd point to the ASLR in Vista as the harbinger of improved Windows security.)

Now the malware problems on both platforms rarely rely on privilege escalation. They use trojan horses instead, and wait for you to install them.

korethr• 13 years ago

All the inherent goodness or badness of the design or implementation of $OS or $APP is ultimately trumped by the user when it comes to security. It is entirely possible to run Windows without any anti-virus/malware protection or firewall, and have the system remain clean for months or years. It is similarly possible to be careless and irresponsible with a Mac or Unix system and have it get compromised in short order. It all depends on the actions of the person running the computer.

makomk2• 13 years ago

At the time when people started saying that, this kind of attack was a lot easier on Windows, because by design installing arbitrary code off the Net was a single click away and the attacker had a huge amount of control over the contents of the request. Since then, Microsoft has improved but Apple has somewhat repeated Microsoft's old mistakes.

eridius3• 13 years ago

Headline says "sighed with Apple ID" as if that's a bad thing, but it's actually a good thing, as it means Apple has already revoked the Apple ID (and presumably the associated certificate), so as soon as your computer updates its certificate revocation list, it will refuse to run the application (even if you try to bypass gatekeeper).

smackfu• 13 years ago

Good and bad. Actually, bad right up until Apple revokes the cert.

pflats2• 13 years ago

Gatekeeper really can't do much against a spear phishing attack. If someone's running a scam specifically to target a single person or a small group of people, and has spent the time and energy figuring out how to get them to open a malicious file, having an Apple ID is a $100 speed bump.

Gatekeeper is meant to prevent a wide-ranging attack. If you've got someone custom crafting an attack vector for you specifically, you've got some serious problems. I don't think Gatekeeper adds any more false security than an antivirus app would, and I don't know of any software that'd prevent an attack like this.

At best, it adds a small amount of information for authorities to try to track the attack. I doubt it'll be fruitful, but it's better than nothing.

defap• 13 years ago

This doesn't make sense. The effectiveness of the spear-fishing attack had nothing to do with Gatekeeper. Signing the app with an Apple ID provided for a straight-forward way to disable the attack, which made Gatekeeper a pure win.

throwaway125• 13 years ago

You can hardly call that good. It's like saying that Diginotar being compromised was good because then we could untrust their CA.

It's true that we could do that, but their original purpose was to protect us in the first place. The same is true for code signing certificates, to a certain extent.

glhaynes5• 13 years ago

The purpose of requiring code signing certificates for default trusted execution on OS X was to make Apple able to blacklist IDs used for malicious purpose (and perhaps to create at least some financial/identification trail). What more would you have wanted code signing to do here?

wyager2• 13 years ago

>it will refuse to run the application (even if you try to bypass gatekeeper).

That sounds kind of shitty to me... Is there any simple way around that?

glhaynes5• 13 years ago

I don't know if there's a way around it but my first thought is that if you're hardcore enough to be needing to run code that's signed with a blacklisted ID, you're way more than hardcore enough to be able to easily make an unsigned (so can't be blacklisted) version of the binary. So if I were Apple I wouldn't waste much time or UI space on it.

eridius3• 13 years ago

You can bypass Gatekeeper for unsigned apps. And you can run signed apps. However, Gatekeeper refuses to let you bypass it for an app whose code signature is damaged or otherwise invalid. This is a feature. If you really truly want to run the app anyway, you can always strip off the code signature.

salimmadjd3• 13 years ago

I posted numerous stuff on Facebook. Critical of both our government (US) and Israel. Then I noticed a lot of Spear phishing emails ostensibly sent from my facebook friends. I use an alias on facebook and they addressed me by my alias name (something friends wouldn't do) so I knew what the nature of the email was. Seems like governments are investing a lot in electronically targeting outspoken individuals.

brown9-2• 13 years ago

Or perhaps your Facebook friends had their own accounts randomly hacked and phishing messages were sent to every one of the account's Facebook friends.

At any given point in time, half of America is posting some sort of critical message about the government online.

salimmadjd3• 13 years ago

So that was my first thought. I accused them of carelessly falling for phishing and other stuff. But they had not seen any emails from their facebook friends or any other phishing attempts. And it seem like I was being targeted by various different facebook friends. Which increased the odds of me being the target.

makomk2• 13 years ago

This is apparently normal these days. I've been receiving phishing e-mails ostensibly from various of my Facebook friends, and I don't think I've pissed off any governments yet.

tomku• 13 years ago

I post nearly nothing on Facebook and am not an activist, and I've been getting the same kind of emails very frequently lately. Some (but not all) of my friends have reported the same. It's likely that it's just random phishing spam.

Edit: To be more specific, the emails use the names of my Facebook friends, but have incorrect sender addresses, indicating that they're just spoofing the name rather than hacking the email accounts of my friends. They're usually fairly short, with an obvious phishing link to a gibberish domain. They come from Facebook friends that I don't necessarily communicate with, and I've confirmed with at least two of those friends that their accounts have not been hacked.

bmohlenhoff• 13 years ago

I was confused why the submission title specifically mentioned that the laptop belonged to an activist, but the end of the article indicates the persons life might be endangered as a result. I can't decide if this is sensationalized or not.

pyre5• 13 years ago

It seems to be quoting a tweet by Jacob Appelbaum. I think that the idea could be that they don't know who put the malware there. As this person was an activist, it's possible that it was there by the government this person was opposing. How does the Angolan government treat activists?

I imagine that if a similar thing happened to an Egyptian activist during Mubarak's time in power that it would not be such a stretch to say such a thing.

nicheuser2• 13 years ago

I first read that as Apple's ID And thought it was like the Microsoft certificate attack.

Looks like Macs market share is growing. Was this distributed in the store?

pyre5• 13 years ago

Probably not. The article said it was from a link in n email. As this was a spearphishing attack, the attacker probably doesn't care that the developer account doesn't work anymore.

acqq• 13 years ago

Exactly. Everybody with 100 USD can get such an ID and then let it be revoked once discovered.

ryannielsen• 13 years ago

It was signed with a Developer ID; thus, by definition, it could not have been distributed in the store.

Anything distributed through the App Store is signed by Apple. Developer ID signed binaries can only be distributed outside of the store.

ancarda• 13 years ago

>the servers used to receive pilfered data from infected machines has been "sinkholed," Intego said. Sinkholing is the term for taking control of the Internet address used in malware attacks so white hats can ensure that compromised computers don't continue to report to servers operated by attackers.

I'd be interested to know how this works? How can you just "take control" over a server/IP address like that? Is there some law that allows botnet control servers to be seized?

kalleboo2• 13 years ago

mailto:abuse@isp.com?subject=ToS%20Violation

deeqkah• 13 years ago

There was a relevant update to iTunes last night (or earlier this week) for both OS X and Windows. It is usually these types of updates i keep an eye out for, as it is most importantly an update to certificate validation.

CVE-2013-1014 as it impacts iTunes for Mac OS X v10.6.8 or later, Windows 7, Vista, XP SP2 or later (http://support.apple.com/kb/HT5766) -

"Impact: An attacker in a privileged network position may manipulate HTTPS server certificates, leading to the disclosure of sensitive information

Description: A certificate validation issue existed in iTunes. In certain contexts, an active network attacker could present untrusted certificates to iTunes and they would be accepted without warning. This issue was resolved by improved certificate validation."

There were almost forty other CVEs for iTunes on Windows. And just a last bit - the discussion and quality of submissions here at Hacker News has taken a substantial fucking nose dive in the last year. I change my name every so often, but i can tell you that i've been here long enough to say that.

Groxx• 13 years ago

In a way, I prefer malware to be signed. If nothing is signed, essentially everything has full permissions, so we'll ignore that part for now, and just look at the differences once malware is signed.

First and foremost, it cost $100 to get the signature. It was paid somehow. Hello money trail, this is way more information on malware authors / pushers than we tend to get. If they somehow obfuscated every bit of data in that account to the point that it's worthless, then it's merely identical to it lacking a signature, no worse.

Second, it can be revoked. This severely limits the spread, reducing the total damage. Sure, the people prior to this are impacted, but they would be if it didn't have a signature, so again, no worse, no matter what.

Third, people click 'yeah, let this program do whatever the hell it wants' all the time, so the lack of a signature really doesn't prevent its spread / limit the damage. Maybe for the techy-elite, but they're less likely to get this anyway. Probably more likely to run unnoticed because it's signed, but I'd argue not by much. Slightly worse.

nutate• 13 years ago

Derp, my girlfriend was at that conference with her macbook air. I feel like I should put a condom on mine now.

Mac malware signed with Apple ID infects activist’s laptop

Related Stories