New Mac Malware Discovered on Dark Web as Security Experts Remind Mac Users Not to Be 'Overconfident'

[MacRumors]

Two new pieces of malicious software aimed at Mac computers have been discovered on the Dark Web, offered through Malware-as-a-Service (MaaS) and Ransomware-as-a-Service (RaaS) portals and estimated to have been up for around the past three weeks, beginning May 25. Originally spotted by Bleeping Computer, the two portals offer software called "MacSpy" and "MacRansom" as services for potential buyers, as well as any future support that may be needed for the malware (via Motherboard).

Both portals are the work of the same malware developer, but security firms Fortinet and AlienVault described the person behind the scheme as an "inexperienced coder," pointing towards issues like the lack of digitally signed files, meaning the security measures on a standard installation of macOS would still be alerted to the malware. The researchers called MacSpy the "better-coded tool," but said MacRansom was more dangerous since it "has the potential to permanently wreck user files," if users of malicious intent ever wielded it.

Dark Web portal peddling some sort of (new?) Mac malware pic.twitter.com/02obWvG4mg - Catalin Cimpanu (@campuscodi) May 25, 2017

Thankfully, the process by which crooks would have to go about getting either MacSpy or MacRansom will likely prevent either piece of malware from spreading. Both portals are described as "closed" offerings, meaning anyone wanting to actually purchase the services off the Dark Web would have to contact the author to receive demo packages, and then directly negotiate payment. As such, "none of these two appear to be part of any active distribution campaigns."

All the same, as Mac-focused security researcher Patrick Wardle told Motherboard, the increasing intent of cyber criminals to infect Apple's computers is "kind of a milestone." Security reporter Ruben Dodge said that macOS and iOS have so many "less technical people" using the software that it's simply too "ripe" of a target for criminals not to take notice. Although MacRansom and MacSpy aren't expected to take off in that way, Dodge said "it's only a matter of time" before another piece of malware or ransomware does.

Ruben Dodge: "There's an ideological shift for Mac and iPhone as being seen as the more friendly OS for older people. [...] It is a market that will be targeted. There are too many less technical people using it not to make it a 'ripe' target for threat actors."

Patrick Wardle: "Apple continues to improve the security of them," Wardle said. "But Mac users should just be cautions, should not be not be overconfident, and should not assume that just because they're using a Mac they're inherently safe."

Malware attacks on Mac computers were up 744 percent in 2016, although that percentage was largely weighted due to adware bundling in software on MacBooks and iMacs, which is far less alarming than any potential wide-scale malware purchased by a criminal on the Dark Web. Still, Bleeping Computer pointed out in its report that Mac ransomware in particular -- which holds user data ransom until a fee is paid -- has been steadily growing over the past year.

The number of Macs has grown, and so has the number of Mac-targeting malware. The launch of MaaS portals, even if hard to use and engage with as MacSpy and MacRansom, will drive more crooks towards the Mac userbase, and will lower the entry bar for some individuals and groups that had no previous experience with creating Mac malware.

As a rule of thumb, in order to stay safe users should only download apps and programs from Apple's own Mac App Store, and if an app is available only on a third-party website the developer behind the software should be trusted. Although Apple has long advertised the Mac as a truly anti-virus and anti-malware machine, Wardle reminds Apple fans to remain vigilant online: "Mac users...should not be overconfident, and should not assume that just because they're using a Mac they're inherently safe."

Article Link: New Mac Malware Discovered on Dark Web as Security Experts Remind Mac Users Not to Be 'Overconfident'

 

[LordQ]

Overconfidence indeed. Shouldn't you use a Virtual Machine with a VPN to browse the Dark Web anyway?

 

[ignatius345]

As a rule of thumb, in order to stay safe users should only download apps and programs from Apple's own Mac App Store, and if an app is available only on a third-party website the developer behind the software should be trusted.

Nope. I check every Mac app I buy to see if it's available directly from the developer so they take 100% of the profits. Let's not use malware as an excuse to make sure the Mac is a walled ecosystem like iOS.

 

[xflashx]

They should finally redesign and rewrite the AppStore completely and change their policies in a way so that developers are more attracted to it. Apps like VLC, texmaker, mactex, Chrome etc. should be present.

Right now the AppStore feels kind of abandoned.

 

[iDento]

Dear Apple,

I'd happily get all my apps from the MacAppStore when you give a damn, like how you redesigned the iOS AppStore for instance.

 

[strayts]

Nope. I check every Mac app I buy to see if it's available directly from the developer so they take 100% of the profits. Let's not use malware as an excuse to make sure the Mac is a walled ecosystem like iOS.

macOS essentially already is. There have been numerous times I've had to disable gatekeeper via the command line to install an app several years out of production. I'm very careful about this, obviously, and I re-enable it once I'm done.

 

[DEMinSoCAL]

Good. Pretty soon I won't have to listen to Apple people claim Mac's are so great because they don't get malware like Windows PC's...the times, they are a'changing...

 

[H2SO4]

Good. Pretty soon I won't have to listen to Apple people claim Mac's are so great because they don't get malware like Windows PC's...the times, they are a'changing...

Never, all they’ll tell you is that this is a worm and Macs still don’t get viruses. Or similar.

 

[wrldwzrd89]

While I agree with the threat of malware for Macs, I see a bigger issue with the recommendation of the Mac App Store. Sure, it's suffering from neglect, but that is merely a symptom of a much larger problem: the store hasn't kept up with its iOS equivalent, which has turned into a disincentive for developers to publish there. Combined with lack of clarity on what apps can and can't do, developers feel that the MAS is too risky. For Apple, this scenario should be ringing alarm bells.

 

[batchtaster]

Never, all they’ll tell you is that this is a worm and Macs still don’t get viruses. Or similar.

You seem to be under the misconception that there is no difference. That the mechanisms, vectors and payloads are indistinguishable or irrelevant.
There very much is, to the extent that the very people who research and combat these things coined the terms.
If you have a problem with the correct use of the terminology - as opposed to deliberately misusing it for sensationalism sake - then perhaps take it up with them.

 

[H2SO4]

You seem to be under the misconception that there is no difference. That the mechanisms, vectors and payloads are indistinguishable or irrelevant.
There very much is, to the extent that the very people who research and combat these things coined the terms.
If you have a problem with the correct use of the terminology - as opposed to deliberately misusing it for sensationalism sake - then perhaps take it up with them.

I’ve seen it here before. Seen it most commonly on the official Apple forums though I must admit. When a new Mac virus pops up, an apologist comes along and says, "No actually it’s a Trojan Horse”. There is a difference of course I know that, but I also know it isn’t the point being made.

 

[batchtaster]

I’ve seen it here before. Seen it most commonly on the official Apple forums though I must admit. When a new Mac virus pops up, an apologist comes along and says, "No actually it’s a Trojan Horse”. There is a difference of course I know that, but I also know it isn’t the point being made.

Well, it exactly is. If you can't get your terminology right, someone is going to correct you.
You could avoid that annoyance by not being wrong and not sounding like you don't know what you're talking about.

 

[wrldwzrd89]

Well, it exactly is. If you can't get your terminology right, someone is going to correct you.
You could avoid the problem by not being wrong.

There's a reason for this stubborn misconception. Back in the early Mac days, predating what was Mac OS X at the time, 90% of malware came in the form of Trojan Horses. People raised in that era who aren't technically inclined remember that a little TOO fondly, failing to realize that's no longer true.

 

[vmachiel]

Overconfidence indeed. Shouldn't you use a Virtual Machine with a VPN to browse the Dark Web anyway?

You just need the TOR browser

 

[H2SO4]

Well, it exactly is. If you can't get your terminology right, someone is going to correct you.
You could avoid that annoyance by not being wrong and not sounding like you don't know what you're talking about.

Don't be so obtuse. I know what I’m talking about and more to the point so do you. When your machine has been compromised who on earth cares whether it was a trojan or virus?
Apple mentioned PC viruses in the advert, you didn't point out the difference in attack vectors there did you?

 

[Fall Under Cerulean Kites]

A piece of trojan software that can destroy files, but that is unsigned and requires manual intervention in order to not just install, but run, is not something I’m going to get excited about.

 

[docfuz]

Overconfidence indeed. Shouldn't you use a Virtual Machine with a VPN to browse the Dark Web anyway?

You just need the TOR browser

I presume you didn't get it right. What this says is not that you may be infected while browsing the dark web. it says that, as a malicious dude, you can rent the malware alongside its services, fake portal, support and future updates on the dark web.

Which is nothing new.

At least in the Windows world. What security researchers are saying it's exactly this. The typical Mac user, usually, is not really aware of the problems. He/she just believes that Mac OS is not vulnerable. In a way, Windows isn't too. Humans are. And now that mac users are rising in numbers, so will the threats.

Well, it exactly is. If you can't get your terminology right, someone is going to correct you.
You could avoid that annoyance by not being wrong and not sounding like you don't know what you're talking about.

Whatever. Even if he is Jon Snow and knows nothing, he got one thing right nonetheless: it's common in mac environments to listen to such apologies: "it's a trojan horse, so OSX is not vulnerable to viruses". Please note that I work in the security field. Since 8.1 and above, with the right settings on UAC, Windows is not bad. Privilege separation and superuser concepts mean nothing, though, when the user is simply pressing the Ok button.

Out in billions, tens of thousands of users/box will be infected. As soon as Mac OS had the same penetration in the market, we could see the same figures. It's human. I work primarily in Mac OS and UNIX environments, at home, too, and I could be considered the local mac evangelist for family and friends. Good. I see trojan horses, viruses, remote file inclusions, worms and you name it, you can have it.

It doesn't happen so often. But I'm talking a few relatives and friends. Multiply this number to even it with windows users' base and you have a problem. Well, the problem we all know.

Our (mac) problem is we think this is not our concern. This is what security researchers keep saying.

doc

p.s. Before we all start the usual - beaten to death - topic regarding virus mechanism in UNIX/multiuser file systems, let's remember that before Apple used viruses as a marketing tool, some researchers provided PoC for Linux/UNIX viruses. Yes, viruses; not trojans, logic bombs or worms. Did they get mainstream? Nope. Why, because it's difficult? No. Because its effort/result ratio is too high. Better to attack the user with something else. Today, even in the Windows world, plain viruses are so rare

 

[ApfelKuchen]

I’ve seen it here before. Seen it most commonly on the official Apple forums though I must admit. When a new Mac virus pops up, an apologist comes along and says, "No actually it’s a Trojan Horse”. There is a difference of course I know that, but I also know it isn’t the point being made.

If you know there's a difference, why do you use the term "virus," which is a self-replicating form of malware, instead of the more general, "malware?"

Perhaps the reason is that, when true viruses emerged as a risk, a huge publicity effort was made to address the risk. Scary stuff - any file attachment you might receive from a friend or co-worker (or stranger) might include a malware payload, which you could then inadvertently pass on to your friends and co-workers. The makers of anti-malware software incorporated the word "virus" into their product names. If someone intent on perpetrating an email hoax included the word "virus" in the subject, the hoax would spread faster than bubonic plague. So yeah, I get it, "virus" became the generic term for any form of malware.

"Macs don't get viruses" is something of a sideshow, semantic quibbling of a sort. However, Mac malware protection goes well beyond classical viruses, and since viruses are, arguably, the easiest-to-spread risk, "no viruses on Mac" is a pretty big thing.

The security experts who published the report are, first and foremost, promoting their careers by playing on fears. That's the nature of nearly all security-related marketing. Is it really a surprise that there are people on the "dark web" trying to sell malware? Let's not forget that anyone can try to sell anything on the web, and that there have been plenty of examples of "malware for sale" that were nothing more than scams or that carried a malicious payload targeted at the downloader (rather than the downloader's intended target).

Apple practices like sandboxing and code signing are not intended to protect the expert user, they're intended to make Apple products relatively safe for the average consumer. That, in turn, works to Apple's commercial ambitions. Is there something so wrong about that?

 

[wrldwzrd89]

A piece of trojan software that can destroy files, but that is unsigned and requires manual intervention in order to not just install, but run, is not something I’m going to get excited about.

Good point; while the default security settings in recent macOS versions will block such programs, the mere existence of it is a sign that we can't rest on our laurels too much, lest we get caught unaware by signed malware or malware using Gatekeeper bypasses.

 

[AlexH]

Dear Apple,

I'd happily get all my apps from the MacAppStore when you give a damn, like how you redesigned the iOS AppStore for instance.

So you don't get your apps from the store because the few minutes spent using the store app upset your aesthetic sensibilities?

 

[cerote]

So you don't get your apps from the store because the few minutes spent using the store app upset your aesthetic sensibilities?

Sometimes the software direct from a devs site has more features not allowed on store. And I saw one piece of software that the Mac store version was subscription based but their version bought from website was one time buy.

 

[darrylsvochak]

While I agree with the threat of malware for Macs, I see a bigger issue with the recommendation of the Mac App Store. Sure, it's suffering from neglect, but that is merely a symptom of a much larger problem: the store hasn't kept up with its iOS equivalent, which has turned into a disincentive for developers to publish there. Combined with lack of clarity on what apps can and can't do, developers feel that the MAS is too risky. For Apple, this scenario should be ringing alarm bells.

 

[UL2RA]

Sometimes the software direct from a devs site has more features not allowed on store. And I saw one piece of software that the Mac store version was subscription based but their version bought from website was one time buy.

This. Kind of frustrating.

 

[wrldwzrd89]

This. Kind of frustrating.

Developers are understandably limited by the sandbox restrictions the Mac App Store imposes, which leads to these feature differences you point out. However, this too is indicative of a different root problem: Apple doesn't seem to realize that neglecting the MAS could cause the failure of iOS sustainability by lack of developer interest. A sub-par experience on the Mac will dissuade developers from downloading Xcode... and without developers, iOS won't have apps. With no apps the incentive to keep using it disappears.

 

[epca12]

It's sad to see this increase but it's inevitable. Lets just hope Apple doesn't avoid this by charging you £50 for the ability to download outside the app store