Showing posts with label proof-of-concept. Show all posts
Showing posts with label proof-of-concept. Show all posts

Friday, July 8, 2011

Current Mac Malware, 2011-07:
Introduction

In order to help Mac users understand the current state of malware on the platform, I am providing a review  of each current form. This will not be an exhaustive review, but should help relieve much misunderstanding and concern about the ongoing, many years old, anti-Apple security FUD Fest.

I will be going through the malware in reverse chronological order, featuring the most current concerns first and the oldies but gnarlies last.

The first thing to know is that technically, ALL currently active Mac malware are Trojan horses. That means that they are entirely inert until such time as a user (or 'LUSER', in cynical terminology) inadvertently installs them.

I am NOT including any hacker tools or 'legal' spyware in my details articles. These require a third party to be able to physically access your computer and directly install them for their nefarious purposes. You won't personally be in any danger of installing them unless a hacker or IT administrator directs you to do so. They require hackers or administrators to access your computer in order for them to do any harm. I may address these forms of software at another time. I am more concerned about what YOU might mistakenly install.

THE LIST:

1) Trojan.OSX.MACDefender.A - O [15 strains]

2) Trojan.OSX.BlackHoleRAT.A - C [3 strains]

3) Trojan.OSX.Boonana.A

4) Trojan.OSX.OpinionSpy.A - B [2 strains]

5) Trojan.OSX.iServices.A - C [3 strains]

6) Trojan.OSX.PokerStealer.A

7) Trojan.OSX.RSPlug.A - Q [17 strains]

The total number of Mac malware species are 7.
The total number of Mac malware strains are 42.


The 'Malware' Hacker Tools I Am Leaving Out:

'Trojan'.OSX.Lamzev.A

'Trojan'.OSX.Hellraiser.A - D [4 strains]

There are a number of inert malware as well as 'Proof of Concept' malware of no concern which I have also left out of my list. You may find them on other lists but you won't find them infecting anyone with up-to-date computers, apart for test computers in a lab. (A famous example of 'Proof of Concept' malware is Trojan.OSX.Oomp.A, aka Trojan.OSX.Leap.A. It is of no consequence or importance).

If you'd like a list of current 'legal' spyware, I suggest the list kindly provided at the MacScan/SecureMac site.

Note that, due to the lack of adherence to standards within the anti-malware community, there are a lot of name variations for the exact same malware. In the case of the MAC Defender Trojan I discovered 15 different names. I am not including them here in my list as these alternative names are irrelevant and needlessly confusing. What I have listed here are the 'official' names from my point of view as well as those whom I consider to be professional experts and original malware discoverers in the field. However, I will be listing a number of the alternative names in my subsequent articles that provide details about each of the current malware species.

As ever, I request corrections to my information. If I have missed a malware species or strain, please let me know asap. Much appreciated!

Wednesday, January 13, 2010

Security FAIL:
When Apple Deserves A *WAKE UP!* Slap

--
Apple are pulling an 'Adobe'. Got a security problem? Sit on it.

Even worse, there's already a solution! So are Apple either (A) OBLIVIOUS or (B) LAZY or (C) STUPID or (D) DGAS? Any one of the above is worth a good *WAKE UP!* slapping.

Here is the story, as presented by SANS in their NewsBites newsletter, Volume 12, Number 3. (Emphasis is mine):

--Proof-of-Concept Code Posted for Mac OS X Flaw
(January 8 & 12, 2010)
Proof-of-concept exploit code for a vulnerability in Mac OS X has been posted on the Internet. The buffer overflow flaw affects versions 10.5 and 10.6 of the Apple operating system and can be exploited remotely. The flaw lies in the libc/gdtoa code in a variety of software products. Apple has known about the vulnerability for seven months, but has not fixed it yet. It has already been fixed in OpenBSD, FreeBSD, NetBSD, Google and Mozilla.
http://isc.sans.org/diary.html?storyid=7942

http://www.informationweek.com/news/security/vulnerabilities/showArticle.jhtml?articleID=222300150

http://www.theregister.co.uk/2010/01/12/critical_osx_security_bug/

Why this inexcusable? Because Apple incorporates code from FreeBSD and OpenBSD into Mac OS X. IOW, it is almost as easy as CUT & PASTE to repair this security hole in Mac OS X.

So what does it take to kick Apple into action? Proof-of-concept code! Let's watch how quickly Apple respond.

Cranial Cogitation:
A lot of people get upset at hackers who FUD Mac OS X, myself included. The thumb-in-your-eye juvenile arrogance some hackers spew is worthy of revulsion. Nonetheless, hackers remain a critical part of the computer community. I look at hackers as part of the essential diversity of the natural world. There is no such thing as a monoculture in nature. Without diversity, any natural system immediately fails. Similarly, without hackers, computer security would FAIL.


So thank you to hackers who take their free time to demonstrate skills in order to improve our computer community. Thank you for kicking Apple in the bollocks when they need it!

The volley is to Apple...





--