Defense: Malware targeting Mac's

In fact (even if this could be the case for this particular malware) if a malware would modify a previously allowed process than it will not get caught.

I guess it doesn't matter that I already proved it does not modify any other processes (you seem to have conveniently forgotten that I showed what files got modified), but whatever.

If you think you know better, say so. I don't think you can, because your knowledge seems restricted to knowing who some security experts are and the names of some good terms and books. If you are a security expert, give us your own analysis. If you know of a security expert who has done an analysis of this trojan and posted anything other than "here's what it looks like, now use my AV software," please let us know. Otherwise, be quiet and let those with information share it.

I think I've stressed enough the weakness of both your analysis and solution. Users that will get this kind of malware will choose either to just delete the files you're pointing at or both follow also my advice to also re-install latest Mac Os X ComboUpdate at this particular stage of the incident whereat there isn't yet an Apple official document.

That said I really hoped this community was a little more of a team trying to improve any solution found to flaws. I was wrong. Bye.

PS I've added some comments to your site addressing the same topic (but with a different attitude cause of course that's your blog and I respect your "house"), we shall see how open you are to suggestions and improvements or to critics. Here is different cause it's not your "house", even though you seem to be in the "elite" of the users of the board.

PPS Another good simple thing to do is also to change the administrator pwd, just in case.

PS I've added some comments to your site addressing the same topic (but with a different attitude cause of course that's your blog and I respect your "house"), we shall see how open you are to suggestions and improvements or to critics.

I did not approve those comments on my blog, as I don't need you confusing the folks reading there, and at least I have control there. In the interest of full disclosure, however, one comment read:

I would at least re-install the latest Mac Os X Combo update after having removed those files. There is no guarantee on your tests that the malware hasn’t also installed a rootkit or a rootkit was installed meantime the infected machine of a user was opened with the trojan horse.

There's so much wrong there I scarcely know where to begin. First, you clearly don't understand what a combo updater does. Installing a combo updater replaces only some of the system files. Yes, if one of those files got modified by malware, that would fix it, but that's a shotgun approach that might hit what you want and might not.

Second, in order for a rootkit to be installed, some files would have to be added to the system that were not added to the system. I have verified this by comparison to a reference system, while booted from a third system. I did not use the tools that you have read about other people using, but that does not make the comparison any less valid.

Your second comment was:

I don’t see why bothering installing a trojan if the only purpose of this malware was to con people and letting them pay for an application that claims something that it doesn’t. That said I personally don’t think your tests are complete and solutions you gave are at least missing a re-install of latest Mac Os X ComboUpdate, in case some system file was changed either during the install or while the system was exposed by the trojan horse. I would recommend you to do a test using also a different tool for Computer Forensic, which is a Integrity Host Monitor such as Osiris or Shamian.

I don’t think this is too paranoid, but instead a good approach to this kind of incidents suggested by people like the shamoo group founders whom cope with this matter every day since a long time.

Moreover I’d rather config ipfw to close any ingoing and outgoing connection and log the result instead of using an application level firewall as Little Snitch to analyze the network behavior of the malware.

Please take this as my two cents to improve your work.

Again, there is a lot wrong with that (some for the same reasons as outlined above), and much of it is irrelevant and confusing to most of the people I'm trying to help.

The one thing I learned from your comments was that you are, apparently (if the address you provided is to be believed), from Italy, so some of your apparent rudeness may in fact simply be language-based. If that is the case, some of my responses to you were probably too harsh, though I still stand by everything I have said.

I do understand what a combo update does.

Indeed originally I said at least re-install lates Mac OS X Combo update, but a better thing would be to re-install the whole system. You can check by yourself.

I have question for you about this part of your document: "Empty the trash. (No need to securely empty.)"

Can you please explain how come you don't want to securely erase those files part of malware?

Another thing: you are sharing personal information of myself on this board that you collected via your personal website. I don't think that is so polite without asking me first if you could enter this infos. By the way, no problem: yes I'm from Italy, and you're right it's a different culture (I've been in US plenty). As I already said I apologize if it might seems I'm rude, that could be just a language difference.

Yet another thing that is actually not so in line with the policy of this board is suggest people to install a malware on their systems.

By the way after all you're showing that you're not democratic as the web requires to be when opening a discussion. You accept comments even if you disagree and then you explain your point. Unless who's commenting is putting spam or doing something else illegal or offending people using your blog.

Can you please explain how come you don't want to securely erase those files part of malware?

Because it serves no purpose. Deleted is deleted. Secure erase only ensures that you can't recover the malware using file recovery software, which is not something anyone is likely to be doing.

you are sharing personal information of myself on this board

What, that you're from Italy? Seriously? I apologize if my attempt to explain your apparent rudeness revealed that you are living somewhere within a 300,000 square kilometer area on the Earth's surface. I'm starting to think, though, that the rudeness is not just a language issue.

Yet another thing that is actually not so in line with the policy of this board is suggest people to install a malware on their systems.

Nowhere have I ever suggested that anyone install malware on their systems.

you're showing that you're not democratic as the web requires to be when opening a discussion.

I didn't open a discussion on my blog. I provided information. I do not welcome comments with inaccurate advice and ridiculous criticism, and I don't need pointless discussions of such things confusing my readers. Note that these forums aren't democratic either... Apple reserves the right to remove anything that violates the terms of use, and the moderators do so all the time.

I was aware of that cause I've been reading a security blog from an AV software house. But when I red replies to your posts that were really cliché style I wanted to support someone making a good point about security without being too paranoid as someone also tried to make you appear.

Moreover I think that I've ran into something similar last year or a couple of years ago but didn't installed the crap, or probably I've installed it without paying and then flushed my system as I usually do quite sometimes for both security and performance reasons.

The thing you're saying about routers being infected too it's something people should start think of too. That is why Osiris has also a module for Linksys routers in order to monitor the integrity of those systems too.

I don't think that including a tool like this (an Host Integrity System) would hurt anybody in next Operating System release. Moreover in one of the book by shmoo group is also described a procedure to deal with this security incidents for later use in court in case the offended person wants to get on the legal part against the intruder.

By the way it was never my intention to personalize anything. The matter is that people here are not techically explaining their choices with their recipes to respond to this kind of incident. I bet you've red some of the stuff I linked, and probably you got what I meant.

Have a good day.

I totally disagree with you about not erasing those files securely exactly because even if remote there is still the probability of them being un-deleted. Still it's a matter of approach, I think different.

DFTT!

Not an acronym for Digital Forensics Tool Testing😉

Rayced wrote:

Ok, you were just trolling in a different thread as you admitted about this matter.

I was not trolling. I was responding to wildly speculative comments made with no basis in fact or evidence by people that seem to be touting their lack of knowledge about this specific malware as a good reason to follow their advice about how to deal with it.

These comments are not helpful. Some are misleading, ignore the security features built into OS X, claim without any concrete evidence whatsoever that this trojan is or could be made into something capable of infecting firmware or installing a rootkit, or otherwise fail to offer any justification for the extreme measures they suggest are necessary to remove it. Some of it is self-contradictory, suggesting a removal measure in one comment that in others they claim is inadequate. Much of it is so vague that it isn't clear what it is supposed to mean. Some of it betrays little or no knowledge of basic security concepts or familiarity with the terminology beyond the buzzword level.

The purpose of ASC is for users to share useful, relevant information derived from their own experience & expertise. It is not to indulge in dubious, over-the-top speculation, or to obfuscate or confuse the issue. Constructive comments are welcome. The rest of it is not, as the Terms of Use make clear.

ds store wrote:

R C -R,

Your suggesting people who have no computer security experience download malware, try it on their systems and then report what happens just to please the Terms of Use?

Certainly not. I am suggesting that the advice of users like Thomas who have tested this trojan on their own systems justifiably is more credible than the speculative advice of those who have not.

So posting about the tools and methods used by a security team that was published now is a speculation over a single case study that is not even made with an initial report of the configuration for the machine used in the test?

Ok, this is really enough. Can you please tell us what titles do you and Mr Reed have to say that me or ds store have not any knowledge? Mr Reed has voluntary installed the malware on his system and wrote a page about it on his blog? That's it? For me is not enough about a security issue.

You were the one negating the existence of a file that ds store was talking about, while other users has reported the existence of that file. I'm sorry but if you are still put it on credibility than you have no credibility at all as well.

Rayced wrote:

So posting about the tools and methods used by a security team that was published now is a speculation over a single case study that is not even made with an initial report of the configuration for the machine used in the test?

You posted nothing specific about any case at all. You mentioned the names of some security specialists, the name of a monitoring tool you represented as the standard, & some vague references to a few types of malware exploits. You have demonstrated no specific knowledge of this malware, of any attempts to analyse it by anyone, or of the security features built into OS X.

Your position is that since you know nothing about this malware, you advise returning the Mac to factory condition. You don't mention anything about how to do that or how to to avoid reinstalling the malware when returning the Mac to a useable state.

You have done nothing but speculate.