Apple has now revoked the certificate (https://blog.malwarebytes.com/threat-analysis/2017/04/new-osx-dok-malware-intercepts-web-traffic/).
Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Malware Uses Apple Developer Certificate to Infect MacOS and Spy on HTTPS Traffic
- Thread starter MacRumors
- Start date
- Sort by reaction score
One downside with this is that it is easy for spammers to guess any of those email addresses. Adding a random string to each email address prevents that.
Why can’t you? I am using a standard account 99.9% of the time. I reserve my admin account for system configuration and installers. Setup and usage is easy.
https://github.com/drduh/macOS-Security-and-Privacy-Guide#admin-and-standard-user-accounts
I say "wish" because I realise this too late and I could not do everything I did in current account easily. Or, maybe I could "downgrade" my current account and create a new admin account.
You should give it a try. Worst-case scenario: you have promote your account again.
Nor is HMRC, the UK equivalent. Nor, I suggest, is any other vaguely competent tax authority.
It looks like this is aimed at people that believe a Nigerian Prince died and left them a million dollars.
It's amazing how people immediately do dumb things when they're afraid. I've had friends respond to e-mails about viruses and taxes, and I almost can't believe what they do. These are well-educated people (well, they think they are).
Critical thought is no longer commonplace (if it ever was), but these days, you can screw up an amazing amount of stuff with one hastily made, and poorly thought-out response to an e-mail or a phone call.
If you want people to do dumb things, just keep 'em scared. Works for politicians and the "News at eleven".
Disabling the developer certificate is something that should happen immediately. Which will cause the legitimate owner of the certificate some problem, but then _they_ didn't look after their certificate. This will prevent any future attacks, unfortunately attacks that have already happened are not stopped.
Mac haz updates for the Mac OS. Pleeze haz updates installed soon so protected. Just press OK when permissions are wanted. Restart your browser may necessity.
Windows Defender in Windows 10 is a full anti-virus package. In Windows 7 & 8.1 it was malware only.
Oh really? Maybe finally become a full package in windows 10 creator update?
Unfortunately, we live in a world of online content with frequent misspellings. That's not to say that even Apple is immune from this, but read the message carefully. "reopen you browser", would have given me a big clue, besides other markers.
You're not wrong, RDP is a great protocol. The issue is that it's a little TOO feature-packed, if what you want is a small subset of what it can do. This added complexity makes it a huge security risk. I like RDP as well, but I shy away from it when I don't need its feature set. I've found that for most use-cases, VNC is more than adequate. Although, I wouldn't use either over the internet directly if at all possible. Tunneling over something more secure is preferable.
LOL! Reminds me of the episode in 30 Rock where Tracy Jordan (Played by Tracy Morgan), casually mentions to his Posse / Bodyguards that the x million dollars from the Nigerian Professor/Prince had arrived in his account.
Sadly, I cannot remember which episode that was!
[doublepost=1493644039][/doublepost]YAWN! "..The latest discovery of malware, which appears to target predominantly European users, underlines the fact that Macs are not immune to the threat as is sometimes supposed..." This is a social engineering problem NOT a Mac OSX security problem. The operating system is fine unless a stupid user hands it the keys to the castle. This is unlike windows where simply receiving the email infects the system without any user intervention. This is as stupid as activating root and handing out the password with your IP on reddit then, when the mac is compromised, screaming 'Macs aren't safe!"
A malware research team has discovered a new piece of Mac malware that reportedly affects all versions of MacOS and is signed with a valid developer certificate authenticated by Apple (via The Hacker News).
The malware has been dubbed "DOK" and is being disseminated through an email phishing campaign which researchers at CheckPoint say is specifically targeting macOS users, making it the first of its kind.
The malware works by gaining administration privileges in order to install a new root certificate on the user's system. This enables it to gain access to all communications between the host Mac and the internet, including traffic flowing through connections encrypted with SSL.
The initial email pretends to be informing the recipient of inconsistencies in their tax return and asks them to download a zip file attachment to their Mac that harbors the malware. Apple's built-in Gatekeeper security feature reportedly fails to recognize it as a threat because of its valid developer certificate, and the malware copies itself to the /Users/Shared/ folder and creates a login item to make itself persistent, even in a rebooted system.
The malware later presents the user with a security message claiming an update is available for the system, for which a password input is required. Following the "update", the malware gains complete control of admin privileges, adjusts the network settings to divert all outgoing connections through a proxy, and installs additional tools that enable it to perform a man-in-the-middle attack on all traffic.
According to the researchers, Mac antivirus programs have yet to update their databases to detect the DOK malware, and advises that Apple revoke the developer certificate associated with the author immediately.
Back in January, researchers discovered a piece of Mac malware called Fruitfly that successfully spied on computers in medical research centers for years before being detected.
The latest discovery of malware, which appears to target predominantly European users, underlines the fact that Macs are not immune to the threat as is sometimes supposed. As always, users should avoid clicking links or downloading attachments in emails from unknown and untrusted sources.
Article Link: Malware Uses Apple Developer Certificate to Infect MacOS and Spy on HTTPS Traffic
No, always a full anti-virus package right from the very first Windows 10 build.
Can't infect anymore, my ***.
You say "infect" like it just magically appears on your computer from nowhere, or by visiting a website and immediately and without any indicator, picking something up (as occurs with Windows). It's a trojan. It pretends to be something other than it is, and requires the user to be fooled. Social engineering is the overarching problem here, not technology. Yes, there are technological issues (rogue developer) that need to be addressed, but this is simply someone assembling legitimate tools (home-brew, certificates, etc) in an illegitimate way. I could do the same thing, and as I am a network admin, deploy it to all the machines I manage.
Safe in your dreams.
[doublepost=1494001038][/doublepost]
An infection is an infection. Saying it's the wrong kind of infection doesn't stop it being an infection.
Good grief, if anyone in this day and age doesn't know to never unzip ANYTHING attached to an email from anyone, then there's no hope for the human race. 99.9% of the time I won't even click on a link in one even from someone I know who NEVER emails me (spoofed). The only emails with attached zip files are poison.
Why aren't they teaching this in PRESCHOOL?
Why aren't they teaching this in PRESCHOOL?
I thought there had already been cases reported where downloading an app from the app store had malware coming along it.
Handbrake had an issue lately https://forums.macrumors.com/thread...load-server-hack.2044676/page-2#post-24559546 doesn't the app store link to Handbrake developers' own mirrors.
Really, that one word got to you so bad? My spirit of speech was something totally else, it was about the perception (that is now changing) that Macs don't get affected and "infected". I did not talk anything about the reason and the cause of said infection at all, to have you so riled up.
Where, exactly, do you read strong emotion like "riled up" into a simple statement of technological clarity, as was my "spirit of speech"? You seem to be bothered by ensuring misconceptions are not propagated. What got you so riled up?Really, that one word got to you so bad? My spirit of speech was something totally else, it was about the perception (that is now changing) that Macs don't get affected and "infected". I did not talk anything about the reason and the cause of said infection at all, to have you so riled up.
Actually, it does. It speaks to the agent and vector of delivery, and thus the nature, underlying cause and weak link. It's the reason there is a distinction between a "virus", "trojan" and other badware. Perhaps raise this with the anti-malware community and ask them to stop making the distinction. If what you're saying is true, why did we drop the very-90s "virus" terminology?