Alas, “Much ado about nothing”. Or not?<\/p>\n
So, if in the last 24 hours you were not buried somewhere you have heard that a some sort of malware for OsX has surfaced. Oh my! “It’s the end of the world as we know it!”. Let’s look into the facts (please note that I’m referring to the analysis done by Andrew<\/a>, which could be wrong, but sounds reasonable)<\/p>\n Coitus interruptus<\/em><\/p>\n Very,very<\/em>, VERY BAD<\/strong>.<\/li>\n<\/ul>\n Now, I see two possibilities:<\/p>\n OR<\/strong><\/p>\n OR<\/strong><\/p>\n All this looks strange to me: you’re on a full-fledged UNIX machine, you have demonstrated a fairly good knowledge of the underlying OS, you can do (or at least try) so much things to 0wn it from the kernel up and you do none? Anyway: at least now Mac users know they may get “infected”<\/strong>, and this is EXTREMELY GOOD<\/strong>, as most security is in the hands of the end users and we simply have no technical solution to human stupidity.<\/p>\n I expect many more “real” viruses and trojans coming for Mac OsX in the next 12-16 months, starting to exploit local buffer overflows, escalating privileges, and doing all the stuff we’re accustomed to. Even in Universal Binary form. :)<\/p>\n So, let’s turn the brain on and click on that Apple again.<\/p>\n I see this post is much longer than I intended it to be: please bear with me :)<\/em><\/p>\n","protected":false},"excerpt":{"rendered":" Alas, “Much ado about nothing”. Or not? So, if in the last 24 hours you were not buried somewhere you have heard that a some sort of malware for OsX has surfaced. Oh my! “It’s the end of the world as we know it!”. C’mon. ** Reality check. ** Nothing is collapsing. Instead, many things … Continue reading “OsX Virus\/Trojan\/that’s-not-the-relevant-thing”<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,3,4],"tags":[],"class_list":["post-116","post","type-post","status-publish","format-standard","hentry","category-english","category-geek","category-security"],"_links":{"self":[{"href":"https:\/\/www.kill-9.it\/blog\/index.php\/wp-json\/wp\/v2\/posts\/116","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kill-9.it\/blog\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kill-9.it\/blog\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kill-9.it\/blog\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kill-9.it\/blog\/index.php\/wp-json\/wp\/v2\/comments?post=116"}],"version-history":[{"count":0,"href":"https:\/\/www.kill-9.it\/blog\/index.php\/wp-json\/wp\/v2\/posts\/116\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.kill-9.it\/blog\/index.php\/wp-json\/wp\/v2\/media?parent=116"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kill-9.it\/blog\/index.php\/wp-json\/wp\/v2\/categories?post=116"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kill-9.it\/blog\/index.php\/wp-json\/wp\/v2\/tags?post=116"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nC’mon. ** Reality check. **<\/strong>
\nNothing is collapsing.
\nInstead, many things are getting better. More on this later on.<\/p>\n\n
apphook.bundle<\/code> into \/Library\/InputManagers\/<\/code> depending if you are an administrative user (read, the nearest to root a user can get under OsX<\/em>) or in your $HOME\/Library\/InputManagers\/<\/code> otherwise. Given that the first user that gets created installing OsX is given administrative rights, I safely assume that around 90% of the clicking users were demi-gods on their machines.Based on common practices: GOOD. Using standard OS application to spread: GOOD. Faking a known buddy, thus bypassing some diffidence: GOOD.<\/strong><\/li>\n$HOME<\/code> or under the \/<\/code>) run in the last month (found using SpotLight) would get replaced by an “infected” executable, with the original moved to a resource fork. Almost untouched executables: GOOD.<\/strong>\n<\/li>\n\n
\nYou’re not a 13 year old boy who wants to go bragging with your friends in IRC, so why stopping there? Why “obfuscating” part of your code using XOR? OMG…
\nYou could start opening connections to somewhere to obtain a backshell, getting command files from the Internet and then executing them… you cold push your code inside executables, you may even have a full compiler and you don’t even look if it’s there?
\nNeither you try a small kernel module to hide your files and\/or your processes? Adore dates back to six years ago…
\nToo many things don’t fit.<\/p>\n