Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Level 7

30,785 points

Defense: Malware targeting Mac's

Mac's users running any browser with JavaScript turned on by default are vulnerable to being tricked into clicking on a trick image and/or link.

That image may appear to be a standard OS X window with a close box or the typical OS X looking window asking a question with OK or Cancel. It can look like anything really, it's purpose is designed to get you to click anywhere on it and initiate a download to your computer.

Safari tries to be helpful and "Open Safe Files" by default, which is being used with numerous success to run code on one's machine, by bypassing the normal user action of 'open the downloads folder and then clicks on the download to run' process in exchange for convenience.

Most Mac's are used with one person, and the initial setup of a new Mac (or a new OS X install) is the first user is automatically a Administrator User. Running one's typical day to day use while in Admin User mode gives any code running on one's machine more privileges and access than it would receive if the user of the computer created another OS X account and ran most of their computer use as a General User.

The ultimate access for rogue code would be Root User, which on Mac's is turned off by default, however a temporary access window to Root User is allowed when a Admin User provides his or her Admin Password. Once rogue code gets Root user access, it's all over, OS X is completely compromised.

The key to security on a Mac, or any computer system actually, is a process called "Compartmentalized Security" where the more privileges code receives, the more it's subjected to time and scrutiny to determine it's legitimacy.

Web browsers are the forward troops facing a overwhelming enemy, the World Wide Web. Not one modern web browser is 100% safe, not Safari, not Firefox, not IE, not Chrome, not Opera. Neither are plug-ins or scripts that run within these browsers 100% safe.

So the key to maintaining security is to provide a high level of "Compartmentalized Security" steps which shifts the exploit potential further down the privilege level so it can't do much of anything or gain further access.

People can get carried away with downloading and installing software in a rapid fire manner, this provides a ripe opportunity for malware to get onto one's computer, even gaining root access right away.

So in order to provide better compartmentalized security, provide more time and steps before potentially installing rouge code. I suggest the following actions:

1: Run most of your day to day computer use as a General User with less privileges. This can be done by creating a new Admin User, logging out of the present user and into the new Admin User, then turning the first user into a General User.

Whenever certain actions are needed, like accessing the Application's folder (where programs can be changed by malware) a Admin Name and Password will be required. A small hassle, but it provides another step for it to get past.

2: Use Firefox web browser and the following Add-ons: NoScript, Ad Block Plus and Public Fox.

Under the Toolbar customization, drag the NoScript button to the toolbar. NoScript turns off all scripts and plug-ins by default, which if you trust the site your on, you click the button for turning them on and the page automatically reloads.

In Public Fox preferences, set a password on downloads, this way a popup window appears before any download occurs, keeping malware from sneaking into your downloads folder and potentially being clicked on.

With Ad Block Plus, subscribe to the Easy List which automatically appears in the browser window. This will auto-update to keep advertising, which has been used numerous times as a attack venue, from appearing.

Click&Clean, Ghostery, BetterPrivacy, FlagFox, WOT, HTTPS-Everywhere (from the Electronic Frontier Foundation) are also highly recommended add-ons.

3: In Safari preferences, turn off "Open Safe Files" install the Ad Block Plus add-on and the Click2Flash add-on. If any add-on appears in the future to simulate what NoScript and Public Fox does on Firefox, then enable those add-ons.

4: Check the staus of your browser plug-ins. These websites makes it easy, bookmark them in a obvious place so you remember to visit them routinely. As soon as a vulnerability appears, either update or turn off the affected plug-in in your browser until a patch is issued.

https://www.mozilla.com/en-US/plugincheck/

https://browsercheck.qualys.com/

5: If you enjoy surfing the backalleys of the Internet and you have at least a decent dual core Intel based Mac, I'd highly advise installing the free VirtualBox and loading a free ISO of Linux Mint DVD 32 bit 10.10 (most consistent and easy to use, everything included, Linux distro)

http://www.virtualbox.org/

http://www.linuxmint.com/download.php

The object is to load and install Linux Mint into the virtual machine like installing a operating system onto a regular computer. Once completed, then save a snapshot to revert to after your Firefox browsing session (in Linux) is completed. All and any potential malware, caches etc is flushed when you revert the entire guest OS back to the earlier state. Keep the Guest OS updated via the Software Update option and save a new snapshot.

6: Use common sense, if it don't look right, then stop and flush the OS X based browser from memory via the Apple > Force Quit menu.

7: Install the free ClamXav, it will remove the OS X malware it knows about, offering some after the fact defense and Windows malware from their files.

http://www.clamxav.com/

I don't advise a full time, always on and running anti-virus solution for Mac's due to Apple's tendancy to change the underlining OS themselves to thwart potential malware. So something like Norton which maintains tight control over OS X should be avoided.

Malware on Mac's are a scarce thing because of Apple's top down approach, but trojans are a potential attack venue and people need to insure more steps to avoid being tricked.

MacBook Pro, Mac OS X (10.6.7), XP, Vista, 7 many Linux distros

Posted on May 8, 2011 4:40 AM

Best reply

thomas_r.

Level 7

31,995 points

Posted on May 8, 2011 5:11 AM

Run most of your day to day computer use as a General User with less privileges.

That causes problems for some apps, which won't run on anything but an admin account or on the account they were installed on. And it's not a guarantee of security - a user who gets in the habit of authenticating to admin to install stuff from their Standard account is no safer than the user who gets in the habit of authenticating to install from their Admin account. This is a good general suggestion, but may not work for everyone and provides practically no real security against "social engineering" by itself.

2: Use Firefox web browser and the following Add-ons: NoScript, Ad Block Plus and Public Fox.

Again, using things like these won't protect you by themselves. How do you know if a site is trusted and should have JavaScript turned on? And most folks are finding this malware via trusted sites that have had malicious JavaScripts "sneaked" into their code, through malicious ads or search engine optimization poisoning. How can you know if your trusted site is affected? And, given how much this malware has been jumping around over the last week, I seriously doubt Ad Block Plus can keep up.

3: In Safari preferences, turn off "Open Safe Files" install the Ad Block Plus add-on and the Click2Flash add-on.

Note that even folks with Safari's Open "safe" files after downloading option turned off have been affected by opening the installer manually. And some have been alerted to the presence of malware by the automatic appearance of the installer. I'd still agree, though, but would add that you should keep your Downloads folder cleaned out, so that any suspicious items that turn up will be easily recognized, and not mistaken for something you downloaded earlier.

As to Click2Flash, I think nobody should be on the web without it! I don't trust Flash as far as I could throw Adobe.

I'd highly advise installing the free VirtualBox and loading a free ISO of Linux Mint DVD 32 bit 10.10

That is not a realistic suggestion for the average person, who will have neither the desire nor the knowledge to run Linux.

6: Use common sense, if it don't look right, then stop and flush the browser from the Apple > Force Quit menu.

This should have been #1! AV software has struggled to keep up with all the variants of MacDefender, malware sites move on sometimes an hour-by-hour basis and malicious code sneaks into trusted sites. In all, no automated defense tool will protect you from a new threat... only your "wetware" can do that!

View in context

86 replies

ds store Author

Level 7

30,785 points

May 10, 2011 10:38 AM in response to a Mac user

a Mac user wrote:

Can you please explain to me how that is going to happen. I have reported 2 methods to apple on privilege escalation so I am fully aware that it is very possible to exploit system access

Great. 🙂

I am questioning this dogma you are ranting about that everything is an open book and nothing is safe.

In regards to browsers? Yes, none of them are 100% safe, some are more safer than others.

Chrome has some exploits that even bypass their sandbox.

http://www.vupen.com/demos/VUPEN_Pwning_Chrome.php

It is far easier to get a user to give you an admin password than it is to exploit the system for it.

Yes it is, just install a log-in item like the MacDefender Trojan does, no Dock icon and just wait for a opportunity to strike.

It is easier because you can just keep doing it, but once apple finds an exploit such as user

escalation they are going to do a system patch and your exploit is gone thus rendering your malicious code inert.

Well if malware gets root, it's not going to get Apple Software Updates any longer. 🙂

Apple goes through long periods before issuing Software Updates, plenty of time for continuous running malware to escalate privileges.

Now, please correct me if I am wrong here but if you wanted to raise **** with a user you do not need to authenticate anything, if you wanted to really wreck their system you will need to authenticate if you are anything short of root.

Depends what User level privileges the code is running in depends upon the severity of the damage to the system. General, Admin or Root.

For most people, losing all their user created files, pictures, music etc., is far worst than a root of their box, and that can occur in General User space with the least amount of privileges.

I was unaware that it was possible to "auto-run" things on download Snow Leopard now has a checker in it that will prompt you before you can run anything you just downloaded.

Yes, I thought that too. But it seems there is a flaw someplace. Likely the "Open Safe Files" is responsible.

I know somewhere in here was a point you are trying to make about how users need to be careful, which I agree that they do.

Right.

However that is not grounds for spouting all this non-sense about how everyone should be hiding in their basements in fear that anything they click could steal their data or destroy their computer. That is just flat out wrong.

I never said anything like that.

May 10, 2011 10:46 AM in response to ds store

My point is that you keep reiterating how this disabled root account is SUDDENLY enabled and accessible by a password that the malicious code uses. At some point you need an administrative password to ENABLE the account or even CHANGE THE PASSWORD. At this point I am confused as to how this middle point happens. Yes it is very possible for it to install itself at login and wait to strike but then you have to question why am I being prompted for my password. Anything using the Authentication Frameworks is safe from being taken, but this does not exclude keyloggers. While keyloggers could be used in this case you would need a way to have a controlled password entry. How is this keylogger going to differentiate between you email password and your account password. My problem with what you are saying is that you are not drawing a bridge between downloading the malware and then the after affects. While you are not wrong in your cases given, the likelihood of these cases happening are so small that it is not worth comparison on large scale. What we are dealing with is basically a social engineering attack where it is allowing the user to make the mistake. If the user does not fall for it then nothing will happen. Exploits are hard to find and use due to the nature of them. They are also short lived due to system patching. Social engineering attacks keep working because the users keep falling for it. The best way to protect against these are to educate your users about their system and how to be cautious. Attacking all these software products because they are "flawed" is not the way do to it. You can only protect against so much before you become too large to be able to manage all the holes.

There are half a dozen "flaws" I could list that would allow someone to be able to gain control of your computer though privilege escalation but non of them can be patched because they are not flaws, but by design. Just because "open safe files" might appear to be flawed to you does not mean it is. Same way that single user booting is not a flaw, because it needs to be there by design.

ds store Author

Level 7

30,785 points

May 10, 2011 12:38 PM in response to a Mac user

a Mac user wrote:

My point is that you keep reiterating how this disabled root account is SUDDENLY enabled and accessible by a password that the malicious code uses.

Well the Root User is always enabled, it's just not accessible in the default OS X setup except through the Admin password with a 5 minute sudo window.

a Mac user wrote:

At some point you need an administrative password to ENABLE the account or even CHANGE THE PASSWORD. At this point I am confused as to how this middle point happens. Yes it is very possible for it to install itself at login and wait to strike but then you have to question why am I being prompted for my password.

That's not a hard barrier to overcome, the malware can wait until the user opens a program that requires it. 🙂

a Mac user wrote:

Anything using the Authentication Frameworks is safe from being taken, but this does not exclude keyloggers. While keyloggers could be used in this case you would need a way to have a controlled password entry. How is this keylogger going to differentiate between you email password and your account password. My problem with what you are saying is that you are not drawing a bridge between downloading the malware and then the after affects. While you are not wrong in your cases given, the likelihood of these cases happening are so small that it is not worth comparison on large scale.

Just because the MacDefender malware authors couldn't hit the entire Mac user base at once doesn't negate the fact there is a exploit potential. This malware is now making the rounds of the Mac underground community for further alteration and exploitation of unsuspecting users.

a Mac user wrote:

What we are dealing with is basically a social engineering attack where it is allowing the user to make the mistake. If the user does not fall for it then nothing will happen. Exploits are hard to find and use due to the nature of them.

Well people who got hit are reporting it suddenly "appeared" on their machines without downloading anything.

A javascript window pops up that looks like a OS X window, and the user clicks to close it, the small download occurs rapidly, it opens it and it runs. If the user goes ahead and gives the admin password, then the Mac is rooted. If they don't, they can shut down the process from the Activity Monitor, delete the log in items, files etc.

a Mac user wrote:

They are also short lived due to system patching.

Like I said before, if the malware gets a Admin password, there won't be any system patching. 🙂

a Mac user wrote:

Social engineering attacks keep working because the users keep falling for it. The best way to protect against these are to educate your users about their system and how to be cautious.

Right, that's why I advocate Safari to have a download warning window before the download occurs, to condition the user to be wary of downloading from the Internet. Other browsers have it and people are fine with it.

a Mac user wrote:

Attacking all these software products because they are "flawed" is not the way do to it.

Until a web browser has the rock solid security like BSD Unix has, then yes, they are all flawed in my opinion.

a Mac user wrote:

You can only protect against so much before you become too large to be able to manage all the holes.

Sounds like a excuse Microsoft would give. 😀

a Mac user wrote:

There are half a dozen "flaws" I could list that would allow someone to be able to gain control of your computer though privilege escalation but non of them can be patched because they are not flaws, but by design.

So the more important it is that rogue code shouldn't be be allowed on a Mac, much less allowed to run.

a Mac user wrote:

Just because "open safe files" might appear to be flawed to you does not mean it is.

Well this is the second time I know of that the default setting of "open safe files" has gotten Mac users into trouble with malware. Perhaps it's just time to remove it.

a Mac user wrote:

Same way that single user booting is not a flaw, because it needs to be there by design.

I think all Mac's in the intial setup should make a Admin and General User password, but don't enable the Admin Account, leave it a optional enable just like the Root User is.

The user then runs as General User all the time.

If the user needs Admin access they can grant themselves (after entering a Admin level password) a time window of whatever minutes they feel they need.

I also feel there should be "time machine" like duplication of what's in the General Users personal folders (music, emails, photo's, videos etc) into the Admin account folders.

This way if malware strikes and wipes out the General Users files or the user accidentally deletes a file, they will at least have a backup in the Admin Account.

roam

Level 6

13,637 points

May 10, 2011 5:04 PM in response to ds store

ds store wrote

"One can't judge by the true address if a link is safe to click on. It might redirect to more malicious sites in a blink."

That's correct and that assertion was not made. I was contributing to Bob's reply, pointing out one more technique, to spot your attempted fakery.

Message was edited by: roam

R C-R

Level 6

17,782 points

May 11, 2011 4:05 AM in response to ds store

ds store wrote:

Well we shouldn't be having to worry about security actually if Apple paid more attention to their browser.

This is exactly the kind of attitude that makes trojans the threat that they are. There is no such thing as absolute security, regardless of what browser you use or what additions it includes.

People's machines are being exploited and the vulnerability is Safari not asking the users permission before initiating a download.

Wrong. Just downloading the trojan will not allow it to exploit anything. Users must install it for that to happen.

Rayced

Level 1

29 points

May 15, 2011 11:25 AM in response to thomas_r.

@Thoma A. Reed: about the very basic suggestion of not using an Administrator user on a daily basis, probably you can find quite interesting that Apple is suggesting that itself, as stated on this official document about installing and config SL secure.

Those applications you mentioned that have problems if run not with an Administrator user are poorly coded and unsafe and need to be re-written/patched, otherwise who's using them is opening its system to potential vulnerabilities.

WZZZ

Level 6

13,226 points

May 15, 2011 11:50 AM in response to Rayced

Thomas wasn't suggesting it wasn't a good idea, just that one should be aware of the possibility some apps installed in an admin account might not be happy campers on a standard account.

ds store Author

Level 7

30,785 points

May 15, 2011 2:01 PM in response to Rayced

Rayced wrote:

Those applications you mentioned that have problems if run not with an Administrator user are poorly coded and unsafe and need to be re-written/patched, otherwise who's using them is opening its system to potential vulnerabilities.

Yes, he knows running as General User is much safer as it has less privileges, especially with this malware running loose on the net being one click away from being on his machine.

Thomas is a old time Mac user like myself, we just have a difference of opinion on what to advise people concerning this issue.

I'm more of a "don't take any chances" "assume the worse" sort of person as I've things turn from bad to worse before.

Also because I'm not a programmer, so I have to assume the worse as I can't read the code.

I just want to know what it takes to completly restore a Mac to it's factory conditions, including all the hidden parts. 🙂

Here's something for you, the NSA OS X hardening handbook

http://www.nsa.gov/ia/guidance/security_configuration_guides/operating_systems.s html#AppleMac

R C-R

Level 6

17,782 points

May 15, 2011 3:00 PM in response to ds store

ds store wrote (& then edited out?):

My discovery of the Firmware.scap file which there isn't anything substancial on the Internet anywhere about it, has got me worried a bit.

Why does a file that helps PC users run OS X illegally on their hardware worry you?

BTW, it takes more than one click to install this malware.

Rayced

Level 1

29 points

May 15, 2011 2:56 PM in response to ds store

@DS Store: I don't have to know the background of a person if what he says is not correct or not complete.

All I know is that the approach you have, even not being a programmer, to security is much more "secure" than what I've read here so far. Figure out that there's people who keep saying there aren't known malware on Mac Os X nowadays still.

By the way, Apple itself suggest to not use an administrator user for daily and common use. Almost all applications are now made with the concept of multi-user with different privileges in mind (which is the first little level for security).

Otherwise it doesn't make sense even not to install Flash Player as correctly Steve Jobs hardly suggested. If the problem for web developers is MAMP, they can just find out a couple of step-by-step guide to simply configure what's already installed on any Mac Os X machines.

R C-R

Level 6

17,782 points

May 15, 2011 3:17 PM in response to Rayced

Rayced wrote:

Figure out that there's people who keep saying there aren't known malware on Mac Os X nowadays still.

There are no known viruses for OS X lose on the Internet. That isn't the same thing as saying there is no known malware for OS X on the Internet.

Thomas Reed has a personal web site that not only has detailed information about identifying & removing this malware, but also a good general guide to Mac malware. It is worth reading if you are unclear about the different types of threats that can affect Macs & how they work.

Rayced

Level 1

29 points

May 15, 2011 3:23 PM in response to R C-R

@R C-R: sure, the problem is that about security on an *NIX system I'd rather read what Bruce Potter, Preston Norvell and Brian Wotring write.

R C-R

Level 6

17,782 points

May 15, 2011 3:48 PM in response to Rayced

Suit yourself, but you might want to consider that OS X is not just another *NIX system. In fact, the OS X kernel is called "xnu." That stands for "X is not UNIX." 🙂

Rayced

Level 1

29 points

May 15, 2011 4:49 PM in response to R C-R

@R C-R: Sir, are you trying to say that an user on this board that played a bit with one malware has more knowledge about security than the founders of "The Shmoo Group"? Have I got your opinion right?

R C-R

Level 6

17,782 points

May 15, 2011 4:59 PM in response to Rayced

What I'm saying is OS X is not just another flavor of UNIX.

If you have something from the Shmoo Group that you think is relevant to this kind of exploit (a trojan using Apple's Installer.app to trick users into installing it) please mention it.

Defense: Malware targeting Mac's