Malwarebytes Discovers 'First Mac Malware of 2017' (securityweek.com) 60
wiredmikey writes: Security researchers have a uncovered a Mac OS based espionage malware they have named "Quimitchin." The malware is what they consider to be "the first Mac malware of 2017," which appears to be a classic espionage tool. While it has some old code and appears to have existed undetected for some time, it works. It was discovered when an IT admin noticed unusual traffic coming from a particular Mac, and has been seen infecting Macs at biomedical facilities. From SecurityWeek.com: "Quimitchin comprises just two files: a .plist file that simply keeps the .client running at all times, and the .client file containing the payload. The latter is a 'minified and obfuscated' perl script that is more novel in design. It combines three components, Thomas Reed, director of Mac offerings at Malwarebytes and author of the blog post told SecurityWeek: 'a Mac binary, another perl script and a Java class tacked on at the end in the __DATA__ section of the main perl script. The script extracts these, writes them to /tmp/ and executes them.' Its primary purpose seems to be screen captures and webcam access, making it a classic espionage tool. Somewhat surprisingly the code uses antique system calls. 'These are some truly ancient functions, as far as the tech world is concerned, dating back to pre-OS X days,' he wrote in the blog post. 'In addition, the binary also includes the open source libjpeg code, which was last updated in 1998.' The script also contains Linux shell commands. Running the malware on a Linux machine, Malwarebytes 'found that -- with the exception of the Mach-O binary -- everything ran just fine.' It is possible that there is a specific Linux variant of the malware in existence -- but the researchers have not been able to find one. It did find two Windows executable files, courtesy of VirusTotal, that communicated with the same CC server. One of them even used the same libjpeg library, which hasn't been updated since 1998, as that used by Quimitchin."
Quim Itchin' (Score:4, Insightful)
Seriously?
Re: (Score:2)
Re: (Score:2)
FYI: Quim means vagina.
Mac OS based espionage malware (Score:3, Informative)
How exactly does the malware get onto the Mac without the end user downloading and installing the malware and providing it with the admin password?
Re: (Score:2, Informative)
From TFA it apparently runs in userspace not as root
Re: (Score:2)
How exactly does 'Quimitchin' execute in userspace without the end user downloading and installing the malware?
Re:Mac OS based espionage malware (Score:4, Informative)
It doesn't. Someone has to authorize it with the admin password.
Re: (Score:3)
It doesn't. Someone has to authorize it with the admin password.
Is this based on anything, or are you just guessing? If you read the comment section of the article someone asked how it spread, and "Does running as a standard user as opposed to an admin account prevent its installation?"
To which the malwarebytes.com blogger said:
That seems to contradict what you have claimed.
Re:Mac OS based espionage malware (Score:5, Insightful)
It doesn't. Someone has to authorize it with the admin password.
Is this based on anything, or are you just guessing?
The article makes it clear that in order to extract and run the malware, you have to extract and install other malware named "Java".
This "Java" is apparently malware developed by a large database company in order to install security holes in otherwise secure computers, and is so named to trick tired programmers into believing that they are installing coffee.
Re: (Score:2)
The article makes it clear that in order to extract and run the malware, you have to extract and install other malware named "Java".
So the article is correct; the malware doesn't have to be authorised with the admin password. The fact that it requires Java just means that it only works on machines with Java installed. Given that it seems to be targeted to a specific industry then it's not an unusual requirement as they are probably using some Java controller software.
You also need to have a Mac for it to run, but that doesn't make people claim that you need to buy the malware from an Apple store.
Re:Mac OS based espionage malware (Score:4, Informative)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
What I want to know is why Malwarebytes does NOT remove Windows 10, the worst malware ever to infest any computer!!!!
How did you manage to get your Mac infested with Windows 10?
Re: (Score:2)
"Biomedical facilities" could just be where larger groups of networked Macs exist in the wild due to their hardware/software use in the biomedical field over the years.
antique system calls (Score:4, Informative)
Comment removed (Score:4, Interesting)
Re: (Score:2)
so old! (Score:2)
Somewhat surprisingly the code uses antique system calls. 'These are some truly ancient functions, as far as the tech world is concerned, dating back to pre-OS X days,'
Kinda sounds like it's using POSIX functions which would be a smart move because they will not be removed in favor of a new API and it makes porting to other platforms easier since most everything is at least partly compliant to POSIX. Perl and Java were good choice since they are on all Apple machines and are resistant to library compatibility issues. This seems like it's a nation-state attack.
Re: (Score:2)
Java on OSX resistant to library compatibility issues?? Are you kidding me?
Re: (Score:2)
Perl and Java were good choice since they are on all Apple machines and are resistant to library compatibility issues.
Java hasn't been part of the default Mac system install for quite a few years.
If you run a program which requires Java, you'll see a pop up telling you Java isn't installed and asking if you want to download the legacy Java runtime. If you say "yes", you'll be directed to an Apple web page where you can download it.
Re: (Score:1)
Perl and Java were good choice since they are on all Apple machines and are resistant to library compatibility issues.
Java hasn't been part of the default Mac system install for quite a few years.
If you run a program which requires Java, you'll see a pop up telling you Java isn't installed and asking if you want to download the legacy Java runtime. If you say "yes", you'll be directed to an Apple web page where you can download it.
And wasn't the possibility of stuff like this partly why Apple deprecated Java in XCode?
Re: (Score:2)
Re: (Score:2)
1. Do you have to go out of your way and invest significant time and effort to avoid the use of these Oracle-owned libraries when you want to develop software in Java?
No, you have to go out of your way to use them.
2. Are you able to write good software without the Oracle-owned libraries? (good = robust, efficient, secure, ...)
Yes, assuming you are able to write good software at all. That is on you.
Re: (Score:2)
Why do the Oracle-owned libraries exist if they are adding zero value?
The same question could be asked of almost everything Oracle produces, including Oracle DB. Corporate customers with too much cash, who trust Oracle. Fortune 500 companies value stability and accountability over a few million here and there, and Oracle provides that.
You can see some of their corporate offerings here, it's #3 and #4 [oracle.com]. #4 is especially instructive, because if you are willing to compile OpenJDK for your device, you don't have to pay anything (which is what Google does now). But some managers
Re: (Score:2)
1. Do you have to go out of your way and invest significant time and effort to avoid the use of these Oracle-owned libraries when you want to develop software in Java?
I'm quite happy to go out of my way to not add an extra 'use expensive commercial features' flag when I invoke the JVM.
2. Are you able to write good software without the Oracle-owned libraries? (good = robust, efficient, secure, ...)
I'd first like to see an existence proof that robust, efficient, and secure software exists, but assuming that axiom, any Java program that works with OpenJDK (i.e. the reference Java implementation) will work without any Oracle-specific things.
Obfuscated perl script (Score:3, Funny)
Brought to you by the department of redundancy department.
Re: (Score:3)
I just checked.
IMPOSSIBLE (Score:1)
MacOSX ... and now a varient on Linux?!@ Complete absurd.
Only WIndows sucks and gets viruses and malware because it is not bless by RMS nor open sourced. You can run things under root for all your mission critical needs with no firewall at all for Apple products and be perfectly safe. Just ask any Apple fanboy and they will tell you or go on slashdot and ask anyone about security on Linux. It is impossible to get malware.
THe author MOST WORK FOR MICROSOFT
Re: (Score:2, Offtopic)
Re: (Score:1)
Re: IMPOSSIBLE (Score:1)
And would certainly ask "Are you really, really sure you want to infect this machine?"
Re: (Score:1)
Re: (Score:1)
Yawn, I should be a security researcher (Score:1)
There have been a string of 'security researchers' being featured here on /. lately that are simply trying to get some limelight just by claiming the perpetrator being the boogeyman-du-jour, actually the same 'security researcher' wrote about a variation of this a few months ago: https://blog.malwarebytes.com/... [malwarebytes.com]
- You need to download it
- You need to run it (with various warnings being thrown up)
- You need to install Java for it to run (which does not come standard on a Mac, requires a significant download
Re:Yawn, I should be a security researcher (Score:4, Interesting)
Are you seriously trying to claim that he is some sort of alarmist? From the link that you provided, it concludes:
And where did the blogger claim the perpetrator of this malware was the boogeyman-du-jour? All I could find was things like:
That doesn't paint the picture of an uber-hacker! At no point was it claimed that this was going to affect us all. In fact, it was said that this has already been fixed by Apple:
If he is trying to "get some limelight" then aren't you also doing the same thing by posting here? Just talking about something is not the same as getting some limelight. This was just another post about the latest malware to be investigated by them. At no point was it hyped as anything new. It discussed the parts of the malware that seemed to be ancient code, as well as the parts that were new. However, I will admit that the headline of "the first Mac malware of 2017" is pretty inflammatory considering that it seems to have been deployed for a while. I think it would have been better said as the first malware of 2017 that he had looked at.
Re: (Score:2)
This quote from the article:
There have been a number of stories over the past few years about Chinese and Russian hackers targeting and stealing US and European scientific research. Although there is no evidence at this point linking this malware to a specific group, the fact that it's been seen specifically at biomedical research institutions certainly seems like it could be the result of exactly that kind of espionage.
seems pretty alarmist to me.
Re: (Score:2)
Why? In what way does it seem implausible? If this malware has only been seen at a certain type of place, what other conclusion is more likely to you? That it is all some giant coincidence and that we should pay no attention to where it was found?
Surely the alarmist thing would be to say that everybody is likely to be attacked by this malware. Or maybe that it was a terrorist plot to release some biological agent into the atmosphere by remote control. But no, it just says that it is probably just everyday i
Re: (Score:2)
So can the security researcher do the planet some good by providing a simple Java app which would clean everything or do we really need to buy Malwarebytes to fix this?
RTFM helps. “Apple calls it 'Fruitfly', and has already released an update that will be automatically downloaded behind the scenes to protect against future infections.”
Re: (Score:2)