Tweaked Trojan Disables Automatic Updating of OS X Anti-Malware Tools

[50548]

It's happening more and more.

You mean malware supposed to lure you into typing an admin password? I had one of these back in 2002. Wake me up when real danger appears.

 

[mdnz]

This is what the official installer for Flash looks like:

If yours look any different, click the installer away and delete it.

 

[primmstereo]

Damn you Flash!! When are you gonna go extinct!! you suck!!

Comment FAIL.

I hope you realize this has nothing to do with Adobe.

 

[munkery]

How do I prevent this from happening on OS 10.5.8?

Trojans and other online scams that require user error to be successful can be avoided by following the suggestions in #8, #9, & #14 in the "Mac Security Suggestions" link found below in my sig.

If you wish to have anti-malware protection similar to that provided by default in SL and Lion, see #10 in the "Mac Security Suggestions" link found below in my sig.

 

[xizar]

The disassembly notes say that it overwrites your plist file with blanks. So yes, what you posted is what you should see for a xprotectupdater.plist.

!! Yay!

Thanks for the info.

 

[Dillenger]

All Your Trojans (and viruses) Belong To Us.

 

[blackhand1001]

Both of these posts are laughably uninformed.

The Mac's resistance to viruses has nothing to do with market share, nor did it have to do with the PowerPC architecture.

There still has never been a virus reported on OS X. Not likely to change any time soon. And that would be the case if Apple had 99% of the PC market.

You can believe that all you want but the hackers at blackhat would disagree. Windows is in fact more secure than mac is at this time. The days of true viruses on pc's are pretty much gone. 99.999% of what you come across are trojan horses. They require user interaction to be executed and with vista and windows 7 they have to be given administrative privileges. Windows vista and 7 will only prompt for administrative privileges if they detect that the file is a proper installer or if its in the compatibility database. So even many trojan horses fail as they do request privilege elevation in vista or 7. The days of self replicating viruses on windows are gone. I am sure there is something out there that can do this, but same goes for mac os. The whole unix privileges thing doesn't mean crap if the user (which is where most of it goes wrong on either platform) gives the trojan permission to run. And on windows vista and 7 since most software has been updated to work with proper permissions you don't see uac any more than you are asked for you password on macos.

 

[ogee]

This is what the official installer for Flash looks like:

Image

If yours look any different, click the installer away and delete it.

Damm Mines a fake, its in English not Dutch!

 

[djrod]

You can believe that all you want but the hackers at blackhat would disagree. Windows is in fact more secure than mac is at this time. The days of true viruses on pc's are pretty much gone. 99.999% of what you come across are trojan horses. They require user interaction to be executed and with vista and windows 7 they have to be given administrative privileges. Windows vista and 7 will only prompt for administrative privileges if they detect that the file is a proper installer or if its in the compatibility database. So even many trojan horses fail as they do request privilege elevation in vista or 7. The days of self replicating viruses on windows are gone. I am sure there is something out there that can do this, but same goes for mac os. The whole unix privileges thing doesn't mean crap if the user (which is where most of it goes wrong on either platform) gives the trojan permission to run. And on windows vista and 7 since most software has been updated to work with proper permissions you don't see uac any more than you are asked for you password on macos.

Sure, that's why last week I deleted 5 virus from my girlfriend's PC with windows 7 that has an antivirus installed!!!

 

[blackhand1001]

Sure, that's why last week I deleted 5 virus from my girlfriend's PC with windows 7 that has an antivirus installed!!!

Those are not viruses, they are trojan horses. She installed them herself(probably because she clicks whatever pops up on the screen).

I recommend everyone here read up on UAC (its more than what apple would like you to think based on their old commercial)
http://technet.microsoft.com/en-us/magazine/2007.06.uac.aspx

 

[anjonjp]

CRAP!! I downloaded a flash update today on my macbook!

What should I do help!! I'm not joking.

Actually, so did I and that is my concern also. I don't understand why you have 8 negatives - there really was a Flash update on my MacBook too.

Can someone else add their input? If this Trojan is masquerading as a Flash Player update, how can we distinguish?

 

[mdnz]

Actually, so did I and that is my concern also. I don't understand why you have 8 negatives - there really was a Flash update on my MacBook too.

Can someone else add their input? If this Trojan is masquerading as a Flash Player update, how can we distinguish?

Compare the image from the first post to the image I posted just a few posts ago. If you installed the one I showed, you're safe.

 

[rocknblogger]

Sorry but it all sound like a paid insert... Sounds like the kind of arguments insurance vendors use.

There are a number of people in this thread that say they installed a flash update but are unsure if it was legit. Doesn't that prove and support exactly what I said? I just don't see the resistance of long time Mac users to some sort of AV app. Just because it hasn't happened does not mean it never will. You can't be that closed minded to believe that. Can you?

And I'm just a regular user like anyone else here. I have no stake in any kind of AV software.

 

[Therbo]

Those are not viruses, they are trojan horses. She installed them herself(probably because she clicks whatever pops up on the screen).

I recommend everyone here read up on UAC (its more than what apple would like you to think based on their old commercial)
http://technet.microsoft.com/en-us/magazine/2007.06.uac.aspx

It took Microsoft till 2007 to make a half-decent half-baked multi-user system, i'm impressed (sarcasm).

I think *NIX had a better implementation since the 70s,

Oh BTW, wasen't there an exploit that actually turned off UAC, LOL.

 

[vahnx]

They don't, this is a Trojan. Big difference

Not to the average user. Trojans and viruses fall under the same category and meaning.

 

[Therbo]

Not to the average user. Trojans and viruses fall under the same category and meaning.

Trojan: Free Porn. Install PornPlayer v3, Please Enter Your Password (SURE I WANT PORN), Infected. PLEASE ENTER YOUR PASSWORD AGAIN AND AGAIN OVER AND OVER FOR MORE PORN, YAY

Virus: Visit Porn in IE, code deletes /system32 without you knowing.


Simple way of putting it,

 

[munkery]

I recommend everyone here read up on UAC

Below is some information and links for those interested in UAC and other security mitigations in Windows.

1) Until Vista, the admin account in Windows did not implement DAC in a way to prevent malware by default. Also, Windows has a far greater number of privilege escalation vulnerabilities that allow bypassing DAC restrictions even if DAC is enabled in Windows.

Much of the ability to turn these vulnerabilities into exploits is due to the insecurity of the Windows registry. Also, more easily being able to link remote exploits to local privilege escalation exploits in Windows is due to the Windows registry.

Mac OS X does not use an exposed monolithic structure, such as the Windows registry, to store system settings. Also, exposed configuration files in OS X do not exert as much influence over associated processes as the registry does in Windows.

Mac OS X Snow Leopard has contained only 4 elevation of privilege vulnerabilities since it was released; obviously, neither of these were used in malware. Lion has contained 2 so far but one of these vulnerabilities doesn't affect all account types because of being due to a permissions error rather than code vulnerability.

The following link shows the number of privilege escalation vulnerabilities in Windows 7 related to just win32k:

http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=win32k+7

More information about privilege escalation in Windows 7:

http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/ -> guide to develop exploits to bypass UAC by manipulating registry entries for kernel mode driver vulnerabilities.

https://media.blackhat.com/bh-dc-11/Mandt/BlackHat_DC_2011_Mandt_kernelpool-wp.pdf -> more complete documentation about Windows kernel exploitation.

http://mista.nu/research/mandt-win32k-paper.pdf -> more complete documentation about alternative methods to exploit the Windows kernel.

http://threatpost.com/en_us/blogs/tdl4-rootkit-now-using-stuxnet-bug-120710 -> article about the TDL-4 botnet which uses a UAC bypass exploit when infecting Windows 7.

2) Windows has the potential to have full ASLR but most software does not fully implement the feature. Most software in Windows has some DLLs (dynamic link libraries = Windows equivalent to dyld) which are not randomized.

http://secunia.com/gfx/pdf/DEP_ASLR_2010_paper.pdf -> article overviewing the issues with ASLR and DEP implementation in Windows.

Also, methods have been found to bypass ASLR in Windows 7.

http://vreugdenhilresearch.nl/Pwn2Own-2010-Windows7-InternetExplorer8.pdf -> article describing bypassing ASLR in Windows 7.

Mac OS X has full ASLR implemented on par with Linux. This includes ASLR with position independent executables (PIE). DLLs in Windows have to be pre-mapped at fixed addresses to avoid conflicts so full PIE is not possible with ASLR in Windows.

Using Linux distros with similar runtime security mitigations as Lion for a model, client-side exploitation is incredibly difficult without some pre-established local access. Of course, this is self defeating if the goal of the exploitation is to achieve that local access in the first place.

See the paper linked below about bypassing the runtime security mitigations in Linux for more details.

http://www.blackhat.com/presentatio...Europe-2009-Fritsch-Bypassing-aslr-slides.pdf

The author only manages to do so while already having local access to the OS.

3) Mac OS X Lion has DEP on stack and heap for both 64-bit and 32-bit processes. Third party software that is 32-bit may lack this feature until recompiled in Xcode 4 within Lion. Not much software for OS X is still 32-bit.

But, not all software in Windows uses DEP; this includes 64-bit software. See first article linked in #2.

4) Mac OS X implements canaries using ProPolice, the same mitigation used in Linux. ProPolice is considered the most thorough implementation of canaries. It is known to be much more effective than the similar system used in Windows.

http://www.blackhat.com/presentations/bh-usa-04/bh-us-04-silberman/bh-us-04-silberman-paper.pdf -> article comparing ProPolice to stack canary implementation in Windows.

5) Application sandboxing and mandatory access controls (MAC) in OS X are the same thing. More specifically, applications are sandboxed in OS X via MAC. Mac OS X uses the TrustedBSD MAC framework, which is a derivative of MAC from SE-Linux. This system is mandatory because it does not rely on inherited permissions. Both mandatorily exposed services (mDNSresponder, netbios...) and many client-side apps (Safari, Preview, TextEdit…) are sandboxed in Lion.

Windows does not have MAC. The system that provides sandboxing in Windows, called mandatory integrity controls (MIC), does not function like MAC because it is not actually mandatory. MIC functions based on inherited permissions so it is essentially an extension of DAC (see #1). If UAC is set with less restrictions or disabled in Windows, then MIC has less restrictions or is disabled.

http://www.exploit-db.com/download_pdf/16031 -> article about Mac sandbox.

http://msdn.microsoft.com/en-us/library/bb648648(v=VS.85).aspx -> MS documentation about MIC.

https://media.blackhat.com/bh-eu-11/Tom_Keetch/BlackHat_EU_2011_Keetch_Sandboxes-Slides.pdf -> researchers have found the MIC in IE is not a security boundary.

6) In relation to DAC and interprocess sandboxing in OS X in comparison with some functionality of MIC in Windows 7 (see #5), the XNU kernel used in OS X has always had more secure interprocess communication (IPC) since the initial release of OS X.

Mac OS X, via being based on Mach and BSD (UNIX foundation), facilitates IPC using mach messages secured using port rights that implement a measure of access controls on that communication. These access controls applied to IPC make it more difficult to migrate injected code from one process to another.

Adding difficulty to transporting injected code across processes reduces the likelihood of linking remote exploits to local exploits to achieve system level access.

As of OS X Lion, the XPC service has also been added to implement MAC (see #5) on IPC in OS X. (http://developer.apple.com/library/...stemStartup/Chapters/CreatingXPCServices.html)

7) Windows has far more public and/or unpatched vulnerabilities than OS X.

http://www.vupen.com/english/zerodays/ -> list of public 0days.

http://www.eeye.com/Resources/Security-Center/Research/Zero-Day-Tracker -> another list of public 0days. (Most if not all of the Apple vulnerabilities in this list were patched in the latest Apple security update -> http://support.apple.com/kb/HT5002)

http://m.prnewswire.com/news-releas...-vulnerability-in-microsoft-os-110606584.html -> article about 18 year old UAC bypass vulnerability.

8) Password handling in OS X is much more secure than Windows.

The default account created in Windows does not require a password. The protected storage API in Windows incorporates the users password into the encryption key for items located in protected storage. If no password is set, then the encryption algorithm used is not as strong. Also, no access controls are applied to items within protected storage.

In Mac OS X, the system prompts the user to define a password at setup. This password is incorporated into the encryption keys for items stored in keychain. Access controls are implemented for items within keychain.

Also, Mac OS X Lion uses a salted SHA512 hash, which is still considered cryptographically secure. It is more robust than the MD4 NTLMv2 hash used to store passwords in Windows 7.

http://www.windowsecurity.com/articles/How-Cracked-Windows-Password-Part1.html -> article about Windows password hashing.

9) The new runtime security mitigation improvements to be included in Windows 8 have already been defeated.

http://vulnfactory.org/blog/2011/09/21/defeating-windows-8-rop-mitigation/

To put this into perspective, methods to bypass the new runtime security mitigations in Mac OS X Lion are not yet available.

In regards to recent earlier version of Mac OS X:

The following image relates to varying levels of security mitigations in different Linux distros but it is applicable in revealing that the runtime security mitigations in some earlier versions of Mac OS X prior to Lion were far from inadequate.



source -> http://www.blackhat.com/presentatio...Europe-2009-Fritsch-Bypassing-aslr-slides.pdf

The following section of that image represents a comparison of Mac OS X Leopard/Snow Leopard to Windows Vista/7.



While Mac OS X Leopard/SL lack full ASLR, Windows Vista/7 have stack canaries (aka stack cookies) that are trivial to bypass.

The following link shows the issues with stack canaries in Windows. -> http://www.blackhat.com/presentations/bh-usa-04/bh-us-04-silberman/bh-us-04-silberman-paper.pdf

So:

Windows Vista/7 = NX + ASLR
Mac OS X Leopard/SL = NX + stack cookies



The image shows that NX in combination with stack canaries is more difficult to bypass than a combination of NX and ASLR.

Admittedly, some apps in Leopard/SL don't use stack canaries but some apps in Vista/7 don't use ASLR. -> http://secunia.com/gfx/pdf/DEP_ASLR_2010_paper.pdf

But, this information does make it seem that the criticism of runtime security mitigations within earlier versions of Mac OS X has been biased and somewhat not as pertinent as some headlines suggest.

The bias in much of the infosec community is obvious.

 

[heimbachae]

So here's a question: does anyone know if there was a legit flash update over the last week? I ,like a few, do remember updating recently on my and my parent's iMacs and I'm now wondering if I didn't just run it by mistake. I wasn't on any sites, it just popped up (I thought from the widget in Preferences) so I just clicked through and haven't worried about it since. Haven't noticed any decrease in speed or anything out of the oridinary. Let me know.

 

[Sankersizzle]

So, we still haven't figured out a way to check if we've been infected?

I am privy to dubious internet dealings, and wouldn't mind knowing if someone is all up in my business.

----------

The F-Secure site has a general description: Link. I scrolled down to the bottom, where it listed the files that this Trojan wipes out and confirmed that at least one of these was still on my system.

[HD] /System/Library/LaunchDaemons/com.apple.xprotectupdater.plist

I clicked on the plist file, and there's content in it, so it's not be overwritten with a blank.

The other file is in the /usr directory, and frankly I'm not worried enough to try and remember how to make this ordinarily hidden directory visible.

I believe that this will indicate whether you are infected or not, but of course if I'm wrong I'm sure someone will chime in.

Luck.

I just checked, I don't even have an com.apple.xprotectupdater.plist file in that directory... Running 10.7.2.

 

[munkery]

I just checked, I don't even have an com.apple.xprotectupdater.plist file in that directory... Running 10.7.2.

In /Library or /System/Library?

Which directory did you check?

 

[heimbachae]

So, we still haven't figured out a way to check if we've been infected?

just found this http://www.f-secure.com/v-descs/trojan-downloader_osx_flashback_c.shtml

 

[Sankersizzle]

In /Library or /System/Library?

Which directory did you check?

Both

 

[charlituna]

I don't understand why these fools waste everyone's time by writing viruses, and I mean for any platform. Can't they put that energy and effort into something positive?

When a little bit of work nets them a crapload of credit cards etc of course they won't stop. And that whole MacDefender thing probably got them a fair bit. mainly from users that don't understand that much about technology and haven't been taught to think things like "I don't remember installing an anti-virus program on the computer"

Same thing with the fake review scams etc. You would think after the first person was caught they would stop but of course they don't

----------

1 - how can we tell if a machine is infected?

Directly on the machine you likely can't.

But to tell if you are at risk, ask yourself if you have downloaded flash player recently (say in the last 4 months) and when you did was it because a site said you needed to so you clicked a download link. ANd did that link take you to the Adobe webpage for flash or just start downloading a file that you then installed.

IF that is the events that occurred, you are very possibly infected. If you took yourself to the Adobe page on your own you are fine.

----------

If you've kept your security updates up-to-date you should be fine. Previously Apple's security updates I think have been pretty good about getting rid of this thing. This is a brand new one that stops your computer from getting updates.

But only until Apple tracks it down, reverse engineers it and releases a new security update that wipes out the wipe out AND redoes how it sets things up so the trojan is no good.

and the dance carries on

----------

If apple merged iOS and OS X (which they won't)

I would be careful saying they won't. The two systems have a lot of the same underpinnings and yes could merge at some point.

And that might not be a bad thing. The auto save features from iOS can be useful as can the whole Launchpad etc. It would be nice if they would let us turn them on and off if we like. And as long as they leave Finder in place for those that like that style who cares about Launchpad.

iOS could pick up a new filing system that might still not let us go in directly (a la a Finder) but would at least put things in one common bucket so for example if I originally open a PDF in ibooks I could close that and open it in Goodreader without having to synch over a second copy or still have the original email to save it to said second program. Or how about if I write a song in Garageband I can save it in a common spot and immediately play it in my 'music' or even use it in iMovie. Without having to dance the sync it to my computer and back over dance.

and with a common OS perhaps we'll get more integration of the computer versions of software with the iOS. Like being able to start a movie in the iOS iMovie and move it to the computer.

these sorts of things are being asked for by many folks as options. And if we had a single OS with two faces perhaps we would get them.

 

[Tech Elementz]

So it switches the updating from automatic to manual use?

OR does it prevent manual updates as well?

 

[adder7712]

That's what you get for installing "Flash" with a dodgy Flash installer.

Adobe's installers are different.

If yours look like this, no sweat.