Security Market Segment LS
Wednesday, 05 September 2018 10:31

Researcher unsure if Apple has acted to curb malware

Taha Karim: "Apple eventually notified us that the issue was closed from their perspective, but it’s unclear whether any specific remediation action was taken." Taha Karim: "Apple eventually notified us that the issue was closed from their perspective, but it’s unclear whether any specific remediation action was taken." Supplied

A researcher based in the United Arab Emirates says he notified Apple about an attack group known as WindShift that had been using vulnerabilities in macOS to target specific individuals in government and critical infrastructure across the Persian Gulf, but does not know whether the company took any measures to remediate the issue.

Taha Karim, from the security firm DarkMatter, told iTWire: "We followed industry-standard responsible disclosure approaches and reported the problem to Apple’s product security team.

"Apple eventually notified us that the issue was closed from their perspective, but it’s unclear whether any specific remediation action was taken."

As iTWire  reported, Karim had claimed the malware used for the attack — known as WindTale and WindTape — could get past native macOS security measures and could exfiltrate documents and also take screenshots of a victim's desktop.

Elaborating on how the malware was spread, Karim said: "This macOS malware is delivered from a specially crafted web page, sent to a victim via a link inside a spear-phishing email. Once the victim clicks on the link, the Web page will serve a zip archive of this malware for download. The Web page, if not closed, will launch the malware via a custom URL-scheme, right after the download.

"This vulnerability results from the fact that the malware custom URL-scheme is automatically added to the Apple LaunchServices database as soon as the malware touches the filesystem. On other operating systems like Microsoft Windows, extra steps are required to add a custom URL scheme : e.g., manually adding a registry key under HKEY_CLASSES_ROOT which requires admin privileges."

He said the technique also worked for network shares. "If the attacker (or end-user inadvertently) copies the malware inside a network share, all the users having this share mapped will have the custom URL scheme automatically added to their LaunchService database. Attackers could use this simple technique to move laterally inside the network resulting in the infection of a larger number of Mac computers."

Karim pointed out that Apple had implemented a user consent pop-up that would be shown the first time the app launched. "[But] unfortunately the name of the app is fully controlled by the attackers and most users can be tricked if the app name is :, .. making it a weak security measure," he added.

Asked about preventive measures, he said: "We advise our customers to not access their personal emails inside their corporate environment, and everyone to lock down the macOS similar to the way they have with other operating systems.

"DarkMatter will publish a hardening guide for macOS by end of September that we are urging our customers to apply. Finally, entities should block access to the domains and identified as associated with these attacks.

"The identified macOS malware doesn’t have a dynamic or configurable C2 server, so for now, blocking these domains will help remediate and identify this threat. DarkMatter has already contacted all its customers with detection, remediation and disinfection routines to remove this threat from any infected macOS computer."

Read 4631 times

Please join our community here and become a VIP.

Subscribe to ITWIRE UPDATE Newsletter here
JOIN our iTWireTV our YouTube Community here


Thoughtworks presents XConf Australia, back in-person in three cities, bringing together people who care deeply about software and its impact on the world.

In its fifth year, XConf is our annual technology event created by technologists for technologists.

Participate in a robust agenda of talks as local thought leaders and Thoughtworks technologists share first-hand experiences and exchange new ways to empower teams, deliver quality software and drive innovation for responsible tech.

Explore how at Thoughtworks, we are making tech better, together.

Tickets are now available and all proceeds will be donated to Indigitek, a not-for-profit organisation that aims to create technology employment pathways for First Nations Peoples.

Click the button below to register and get your ticket for the Melbourne, Sydney or Brisbane event



It's all about Webinars.

Marketing budgets are now focused on Webinars combined with Lead Generation.

If you wish to promote a Webinar we recommend at least a 3 to 4 week campaign prior to your event.

The iTWire campaign will include extensive adverts on our News Site and prominent Newsletter promotion and Promotional News & Editorial. Plus a video interview of the key speaker on iTWire TV which will be used in Promotional Posts on the iTWire Home Page.

Now we are coming out of Lockdown iTWire will be focussed to assisting with your webinars and campaigns and assistance via part payments and extended terms, a Webinar Business Booster Pack and other supportive programs. We can also create your adverts and written content plus coordinate your video interview.

We look forward to discussing your campaign goals with you. Please click the button below.


Sam Varghese

Sam Varghese has been writing for iTWire since 2006, a year after the site came into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.

Share News tips for the iTWire Journalists? Your tip will be anonymous




Guest Opinion

Guest Interviews

Guest Reviews

Guest Research

Guest Research & Case Studies

Channel News