Security Market Segment LS
Wednesday, 05 September 2018 10:31

Researcher unsure if Apple has acted to curb malware

Taha Karim: "Apple eventually notified us that the issue was closed from their perspective, but it’s unclear whether any specific remediation action was taken." Taha Karim: "Apple eventually notified us that the issue was closed from their perspective, but it’s unclear whether any specific remediation action was taken." Supplied

A researcher based in the United Arab Emirates says he notified Apple about an attack group known as WindShift that had been using vulnerabilities in macOS to target specific individuals in government and critical infrastructure across the Persian Gulf, but does not know whether the company took any measures to remediate the issue.

Taha Karim, from the security firm DarkMatter, told iTWire: "We followed industry-standard responsible disclosure approaches and reported the problem to Apple’s product security team.

"Apple eventually notified us that the issue was closed from their perspective, but it’s unclear whether any specific remediation action was taken."

As iTWire  reported, Karim had claimed the malware used for the attack — known as WindTale and WindTape — could get past native macOS security measures and could exfiltrate documents and also take screenshots of a victim's desktop.

Elaborating on how the malware was spread, Karim said: "This macOS malware is delivered from a specially crafted web page, sent to a victim via a link inside a spear-phishing email. Once the victim clicks on the link, the Web page will serve a zip archive of this malware for download. The Web page, if not closed, will launch the malware via a custom URL-scheme, right after the download.

"This vulnerability results from the fact that the malware custom URL-scheme is automatically added to the Apple LaunchServices database as soon as the malware touches the filesystem. On other operating systems like Microsoft Windows, extra steps are required to add a custom URL scheme : e.g., manually adding a registry key under HKEY_CLASSES_ROOT which requires admin privileges."

He said the technique also worked for network shares. "If the attacker (or end-user inadvertently) copies the malware inside a network share, all the users having this share mapped will have the custom URL scheme automatically added to their LaunchService database. Attackers could use this simple technique to move laterally inside the network resulting in the infection of a larger number of Mac computers."

Karim pointed out that Apple had implemented a user consent pop-up that would be shown the first time the app launched. "[But] unfortunately the name of the app is fully controlled by the attackers and most users can be tricked if the app name is :, .. making it a weak security measure," he added.

Asked about preventive measures, he said: "We advise our customers to not access their personal emails inside their corporate environment, and everyone to lock down the macOS similar to the way they have with other operating systems.

"DarkMatter will publish a hardening guide for macOS by end of September that we are urging our customers to apply. Finally, entities should block access to the domains and identified as associated with these attacks.

"The identified macOS malware doesn’t have a dynamic or configurable C2 server, so for now, blocking these domains will help remediate and identify this threat. DarkMatter has already contacted all its customers with detection, remediation and disinfection routines to remove this threat from any infected macOS computer."


You cannot afford to miss this Dell Webinar.

With Windows 7 support ending 14th January 2020, its time to start looking at your options.

This can have significant impacts on your organisation but also presents organisations with an opportunity to fundamentally rethink the way users work.

The Details

When: Thursday, September 26, 2019
Presenter: Dell Technologies
Location: Your Computer


QLD, VIC, NSW, ACT & TAS: 11:00 am
SA, NT: 10:30 am
WA: 9:00 am NZ: 1:00 pm

Register and find out all the details you need to know below.



iTWire can help you promote your company, services, and products.


Advertise on the iTWire News Site / Website

Advertise in the iTWire UPDATE / Newsletter

Promote your message via iTWire Sponsored Content/News

Guest Opinion for Home Page exposure

Contact Andrew on 0412 390 000 or email [email protected]


Sam Varghese

website statistics

Sam Varghese has been writing for iTWire since 2006, a year after the site came into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.



Recent Comments