Stealing Advanced Nations' Mac Malware Isn't Hard. Here's How One Hacker Did It (arstechnica.com) 19
Malware developers are always trying to outdo each other with creations that are stealthier and more advanced than their competitors'. At the RSA Security conference last week, a former hacker for the National Security Agency demonstrated an approach that's often more effective: stealing and then repurposing a rival's code. From a report: Patrick Wardle, who is now a security researcher at the macOS and iOS enterprise management firm Jamf, showed how reusing old Mac malware can be a smarter and less resource-intensive approach for deploying ransomware, remote access spy tools, and other types of malicious code. Where the approach really pays dividends, he said, is with the repurposing of advanced code written by government-sponsored hackers. "There are incredibly well-funded, well-resourced, very motivated hacker groups in three-letter agencies that are creating amazing malware that's fully featured and also fully tested," Wardle said during a talk titled "Repurposed Malware: A Dark Side of Recycling." "The idea is: why not let these groups in these agencies create malware and if you're a hacker just repurpose it for your own mission?" he said.
To prove the point, Wardle described how he altered four pieces of Mac malware that have been used in in-the-wild attacks over the past several years. The repurposing caused the malware to report to command servers belonging to Wardle rather than the servers designated by the developers. From there, Wardle had full control over the recycled malware. The feat allowed him to use well-developed and fully featured applications to install his own malicious payloads, obtain screenshots and other sensitive data from compromised Macs, and carry out other nefarious actions written into the malware.
To prove the point, Wardle described how he altered four pieces of Mac malware that have been used in in-the-wild attacks over the past several years. The repurposing caused the malware to report to command servers belonging to Wardle rather than the servers designated by the developers. From there, Wardle had full control over the recycled malware. The feat allowed him to use well-developed and fully featured applications to install his own malicious payloads, obtain screenshots and other sensitive data from compromised Macs, and carry out other nefarious actions written into the malware.
one interesting snipplet from TFA (Score:5, Insightful)
“With a single modification to the binary, (and building a light-weight C&C server), we now have access to an advanced nation-state loader that will perform to our bidding ...without having to write any (client-side) code!” Wardle wrote in a message following his talk. “This is way easier than writing it from scratch :) Also, if this repurposed variant is ever detected, it will likely be misattributed back to the North Koreans.”
Makes you wonder, doesn't it?
Re: (Score:2)
Re: (Score:2)
Malware/viri are developed to beat a system that detects a fingerprint. This means that the code for each iteration of a virus or malware is always slightly different. So, in the end, the mechanism that allows the malware to slide through the antivirus software, is the same mechanism that will make it likely (he said "likely" and not "always") misattributed.
War and pieces. (Score:2)
Almost makes one want to unplug doesn't it? The internet is turning into a war/greedzone with everyone and their dog out to get each other and you.
Re: (Score:2)
Almost makes one want to unplug doesn't it? The internet is turning into a war/greedzone with everyone and their dog out to get each other and you.
We humans managed to take this host planet and carve it up into countries. What's yours is yours, and what's mine is mine. Or at least until I decide what's yours is mine too. And then we go to war. Later, rinse, and repeat for oh I dunno, the last few thousand years.
At some point, we humans gave birth to this virtual world. But it's still a world built and represented by, humans. With regards to all that "war/greedzone" shit, what the fuck did you expect would happen?
Even Nostradamus' dog could hav
Re: (Score:2)
Yup - I love how people want to send *people* to Mars, and expect some sort of different outcome.
Re: (Score:2)
One of the themes that emerges from Asimov's robot stories is that robots are actually better people than people are. They have a code (well, *code* I guess) that they don't violate; hypocrisy is literally impossible for them.
This is not entirely science fiction. There's a saying in Washington politics: if you want a friend in this town, get a dog. Arguably humans have spent 20,000 years of selective breeding to transform the wolf in a companion that can reliably give you what you want from other people,
Re: (Score:2)
The people who have power are the sorts of people who want power. Not much can be done about that, really, beyond trying to limit how much power we give those guys just on general principles.
Re: (Score:2)
Sounds familiar... (Score:3)
Good artist copy, great artist steal
?
Re: Sounds familiar... (Score:2)
Well, it wasn't an artist who said it. More of a technology huckster.
Re: (Score:2)
What's your standard for art?!
Sounds like they just discovered... (Score:1)
...skript kiddies.
Re: (Score:2)
Any sort of attribution along the lines of "we know this was done by NK, China, Moscow, Iran, whatever", because they used malware which was previously used by Fancy Moron, Fancy Bear, Fancy W*nker, etc group has absolutely zero value.
In fact it is deliberately misleading and any "researcher" trying to attribute something to CIA, KGB, GRU, Mossad etc on the grounds of "they are usi
Not hard?! (Score:4, Funny)
Haha its totally not hard people this guy did it:
https://www.linkedin.com/in/pa... [linkedin.com]
heres the easy to follow steps!
1. Graduate from Johns Hopkins with 2 masters degrees in computer science and security
2. Work for NASA, NSA and a half dozen other top tech companies as a Director of research, Chief Security Officer, etc.
3. Obtain and reverse engineer advanced mac malware using the latest sophisticated technology and techniques.
4. Profit!
This 'hacker' did it and so can you!
Macs have malware? (Score:1)
I thought part of the secret sauce with Apple products was no malware. I guess I woke up in a different decade.
"Stealing" (Score:2)
Scriptkiddies? (Score:2)
I don't understand why this is some grand piece of advice... I mean the hacker world has been doing this for a good 2-3 decades... since sneakernet?
Thats why they are called "Scriptkiddies". You take other people's effective code and alter it a tiny bit to have it do what you need. Sometimes simply edit the header files. Same with DRM hacking, the game hacks aren't reinvented over and over again; the same base hack is retooled against a new game.
Hackers "outdo" each other because of the challenge. We c