Security Market Segment LS
Wednesday, 05 September 2018 10:31

Researcher unsure if Apple has acted to curb malware

Taha Karim: "Apple eventually notified us that the issue was closed from their perspective, but it’s unclear whether any specific remediation action was taken." Taha Karim: "Apple eventually notified us that the issue was closed from their perspective, but it’s unclear whether any specific remediation action was taken." Supplied

A researcher based in the United Arab Emirates says he notified Apple about an attack group known as WindShift that had been using vulnerabilities in macOS to target specific individuals in government and critical infrastructure across the Persian Gulf, but does not know whether the company took any measures to remediate the issue.

Taha Karim, from the security firm DarkMatter, told iTWire: "We followed industry-standard responsible disclosure approaches and reported the problem to Apple’s product security team.

"Apple eventually notified us that the issue was closed from their perspective, but it’s unclear whether any specific remediation action was taken."

As iTWire  reported, Karim had claimed the malware used for the attack — known as WindTale and WindTape — could get past native macOS security measures and could exfiltrate documents and also take screenshots of a victim's desktop.

Elaborating on how the malware was spread, Karim said: "This macOS malware is delivered from a specially crafted web page, sent to a victim via a link inside a spear-phishing email. Once the victim clicks on the link, the Web page will serve a zip archive of this malware for download. The Web page, if not closed, will launch the malware via a custom URL-scheme, right after the download.

"This vulnerability results from the fact that the malware custom URL-scheme is automatically added to the Apple LaunchServices database as soon as the malware touches the filesystem. On other operating systems like Microsoft Windows, extra steps are required to add a custom URL scheme : e.g., manually adding a registry key under HKEY_CLASSES_ROOT which requires admin privileges."

He said the technique also worked for network shares. "If the attacker (or end-user inadvertently) copies the malware inside a network share, all the users having this share mapped will have the custom URL scheme automatically added to their LaunchService database. Attackers could use this simple technique to move laterally inside the network resulting in the infection of a larger number of Mac computers."

Karim pointed out that Apple had implemented a user consent pop-up that would be shown the first time the app launched. "[But] unfortunately the name of the app is fully controlled by the attackers and most users can be tricked if the app name is :, .. making it a weak security measure," he added.

Asked about preventive measures, he said: "We advise our customers to not access their personal emails inside their corporate environment, and everyone to lock down the macOS similar to the way they have with other operating systems.

"DarkMatter will publish a hardening guide for macOS by end of September that we are urging our customers to apply. Finally, entities should block access to the domains and identified as associated with these attacks.

"The identified macOS malware doesn’t have a dynamic or configurable C2 server, so for now, blocking these domains will help remediate and identify this threat. DarkMatter has already contacted all its customers with detection, remediation and disinfection routines to remove this threat from any infected macOS computer."


26-27 February 2020 | Hilton Brisbane

Connecting the region’s leading data analytics professionals to drive and inspire your future strategy

Leading the data analytics division has never been easy, but now the challenge is on to remain ahead of the competition and reap the massive rewards as a strategic executive.

Do you want to leverage data governance as an enabler?Are you working at driving AI/ML implementation?

Want to stay abreast of data privacy and AI ethics requirements? Are you working hard to push predictive analytics to the limits?

With so much to keep on top of in such a rapidly changing technology space, collaboration is key to success. You don't need to struggle alone, network and share your struggles as well as your tips for success at CDAO Brisbane.

Discover how your peers have tackled the very same issues you face daily. Network with over 140 of your peers and hear from the leading professionals in your industry. Leverage this community of data and analytics enthusiasts to advance your strategy to the next level.

Download the Agenda to find out more


Sam Varghese

website statistics

Sam Varghese has been writing for iTWire since 2006, a year after the site came into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.



Recent Comments