Home Security Researcher unsure if Apple has acted to curb malware
Taha Karim: "Apple eventually notified us that the issue was closed from their perspective, but it’s unclear whether any specific remediation action was taken." Taha Karim: "Apple eventually notified us that the issue was closed from their perspective, but it’s unclear whether any specific remediation action was taken." Supplied

A researcher based in the United Arab Emirates says he notified Apple about an attack group known as WindShift that had been using vulnerabilities in macOS to target specific individuals in government and critical infrastructure across the Persian Gulf, but does not know whether the company took any measures to remediate the issue.

Taha Karim, from the security firm DarkMatter, told iTWire: "We followed industry-standard responsible disclosure approaches and reported the problem to Apple’s product security team.

"Apple eventually notified us that the issue was closed from their perspective, but it’s unclear whether any specific remediation action was taken."

As iTWire  reported, Karim had claimed the malware used for the attack — known as WindTale and WindTape — could get past native macOS security measures and could exfiltrate documents and also take screenshots of a victim's desktop.

Elaborating on how the malware was spread, Karim said: "This macOS malware is delivered from a specially crafted web page, sent to a victim via a link inside a spear-phishing email. Once the victim clicks on the link, the Web page will serve a zip archive of this malware for download. The Web page, if not closed, will launch the malware via a custom URL-scheme, right after the download.

"This vulnerability results from the fact that the malware custom URL-scheme is automatically added to the Apple LaunchServices database as soon as the malware touches the filesystem. On other operating systems like Microsoft Windows, extra steps are required to add a custom URL scheme : e.g., manually adding a registry key under HKEY_CLASSES_ROOT which requires admin privileges."

He said the technique also worked for network shares. "If the attacker (or end-user inadvertently) copies the malware inside a network share, all the users having this share mapped will have the custom URL scheme automatically added to their LaunchService database. Attackers could use this simple technique to move laterally inside the network resulting in the infection of a larger number of Mac computers."

Karim pointed out that Apple had implemented a user consent pop-up that would be shown the first time the app launched. "[But] unfortunately the name of the app is fully controlled by the attackers and most users can be tricked if the app name is : Safari.app, Mail.app .. making it a weak security measure," he added.

Asked about preventive measures, he said: "We advise our customers to not access their personal emails inside their corporate environment, and everyone to lock down the macOS similar to the way they have with other operating systems.

"DarkMatter will publish a hardening guide for macOS by end of September that we are urging our customers to apply. Finally, entities should block access to the domains string2me.com and flux2key.com identified as associated with these attacks.

"The identified macOS malware doesn’t have a dynamic or configurable C2 server, so for now, blocking these domains will help remediate and identify this threat. DarkMatter has already contacted all its customers with detection, remediation and disinfection routines to remove this threat from any infected macOS computer."

CDAO SYDNEY TURNS 5 IN 2019

With 50+ Speakers, 300+ senior data and analytics executives, over 3 exciting days you will indulge in all things data and analytics before leaving with strategic takeaways that will catapult you ahead on your journey

· CDAO Sydney is designed to bring together senior executives in data and analytics from progressive organisations
· Improve operations and services
· Future proof your organisation in this rapidly changing technological landscape
· CDAO Sydney 2-4 April 2019
· Don’t miss out! Register Today!
· Want to find out more? Download the Agenda

REGISTER HERE!

LEARN HOW TO REDUCE YOUR RISK OF A CYBER ATTACK

Australia is a cyber espionage hot spot.

As we automate, script and move to the cloud, more and more businesses are reliant on infrastructure that has the high potential to be exposed to risk.

It only takes one awry email to expose an accounts’ payable process, and for cyber attackers to cost a business thousands of dollars.

In the free white paper ‘6 Steps to Improve your Business Cyber Security’ you’ll learn some simple steps you should be taking to prevent devastating and malicious cyber attacks from destroying your business.

Cyber security can no longer be ignored, in this white paper you’ll learn:

· How does business security get breached?
· What can it cost to get it wrong?
· 6 actionable tips

DOWNLOAD NOW!

Sam Varghese

website statistics

Sam Varghese has been writing for iTWire since 2006, a year after the sitecame into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.

 

Popular News

 

Telecommunications

 

Sponsored News

 

 

 

 

Connect