Bugs Allowed Hackers To Make Malware Look Like Apple Software (vice.com) 72
An anonymous reader shares a report: For years, hackers could hide malware alongside legitimate Apple code and sneak it past several popular third-party security products for Mac computers, according to new research. This is not a flaw in MacOS but an issue in how third-party security tools implemented Apple's APIs. A researcher from security firm Okta found that several security products for Mac -- including Little Snitch, xFence, and Facebook's OSquery -- could be tricked into believing malware was Apple code, and let it past their defenses. "I can take malicious code and make it look like it's signed by Apple," Josh Pitts, the security researcher at Okta who discovered these bugs, told Motherboard. In a blog post published Tuesday, Pitts explained that the issue lies with how the third-party security tools implemented Apple's code-signing APIs when dealing with Mac's executable files known as Universal or Fat files.
The balances with security products. (Score:5, Interesting)
We all hate virus scanners, and other security products, because they slow our systems way down, they often will slow our systems more then the actual malware would. However the designers need to find some sweet spot on speed of their tools vs effectiveness of these tools. So flaws like this is understandable, because actually validating the signature will take more time to process vs. the current number of malware that uses this trick.
Now that it is known, I expect security companies will now have to fix their code to check for this, and slow our systems down further. Part of the popularity of these closed ecosystems of iOS vs MacOS is the ability to only allow good actors to work on your platform, while blocking any unknown actors (good or bad) from causing harm, reducing the need for external security software which will slow the system down.
Re:The balances with security products. (Score:4, Insightful)
What I "hate" (that's a strong word) is that there's no Free OS that is based first and foremost around the concept of security. I for one would be happy to give up most of my system's performance for a significant improvement in security, especially if the system were also more reliable. I can have a second system for high-performance tasks.
Most people who are not gamers have much more computing power than they really need now (at least in desktops and laptops) and spend most of their time web browsing. Their systems are mostly idle and they could afford to give away substantial performance in exchange for security.
Re: (Score:3)
OpenBSD or am I walking into a Troll?
However the big issue with OpenBSD is that it isn't designed well for general computing that we do on our PC's. Being everything that is potentially dangerous is closed and/or locked down. It means when ever we need to do something new, we need to consciously turn off a security feature. While great for hosting and servers where such rigor should be the norm. For your PC it can get annoying rather quickly.
Re: (Score:3)
OpenBSD or am I walking into a Troll?
However the big issue with OpenBSD is that it isn't designed well for general computing that we do on our PC's.
OpenBSD wasn't designed for security first, it was developed from BSD. Security was an afterthought. Fixing holes in BSD is their focus, and while it's not a waste of time, it's not the same as designing an OS for security from day one.
Re: (Score:2)
Qubes?
Re: (Score:2)
Do you not count Qubes?
I'd prefer not to have to virtualize entire operating systems in order to run applications. How well does it work without GPU virtualization?
Re: (Score:2)
It depends on if your motherboard and CPU support IOMMU at appropriate levels. Oh, and it likely requires you to have 2 graphics cards available, also, so laptops, Macs and AIO-systems are SOL.
I've got two graphics cards, but they are only 950s so I use them in SLI because otherwise they are slowwwww. (One was an RMA replacement for a 750 Ti, then I bought the other one.)
Re: (Score:2)
no Free OS that is based first and foremost around the concept of security.
This sounds nice, but in practice it would wind up pretty much the same as the other flavors of OS. The most secure computer is one that it off - do anything useful with it, and you start to make security compromises. The compromises add up to a balance of security and usefulness that exist in every modern OS, and that same dynamic would be true in a "secure OS" even if it started from the other extreme. As the other commenters mentioned, OpenBSD and Qubes exist. Yeah, they modified other OSes (BSD and Xen,
Re: (Score:2)
That's bullshit. You only need to validate each signature once when the app is downloaded / executed for the first time. How many times a day are you doing that? Vanishingly small. It's not a significant source of slowdown.
Even if it was, your risk / reward tradeoff is all wrong. You're saving a few seconds a day of processing time, w
Re: (Score:2)
Malware becomes the approved, trusted and secure security products and creates crypto currency over a year.
All the user can see is trusted and approved apps working in the background.
That's funny... (Score:1)
Re: (Score:1)
What you should be afraid of is the likelihood that eventually you will only be able to install into Windows from their store.
Then your choice will be Microsoft's walled Garden, Apple's walled garden, or rolling your own via Linux.
I can see Microsoft going that route.
Re: (Score:2)
iTunes has been available on Windows for quite some time now. All those windows users that bought an iPhone or iPad and need to put stuff on it.
It's a lot easier on the windows users to go to the MS store where the download and installation process is familiar.
Of course iTunes's time as the "gateway to the iPhone" is on borrowed time. Apple is moving away from that to direct cloud access. Users can already do almost everything iTunes can do directly with Apple from their iDevice. By 2020 iTunes probably
Re: (Score:1)
iTunes has been available on Windows for quite some time now.
Until recently as a downloadable installer from Apple.
All those windows users that bought an iPhone or iPad and need to put stuff on it.
I have never synced my iOS devices to a PC. I do watch iTunes movies on my PC screen.
It's a lot easier on the windows users to go to the MS store where the download and installation process is familiar.
As a Windows user since 3.11, this was my first time using Microsoft App Store.
Of course iTunes's time as the "gateway to the iPhone" is on borrowed time. Apple is moving away from that to direct cloud access.
That was two or three years ago.
Re: (Score:2)
Re: (Score:2)
It's a lot easier on the windows users to go to the MS store where the download and installation process is familiar.
Most Windows users have never touched the Windows Store, it's not really that familiar to most.
You mean . . . (Score:2)
As an XCode user I thought (Score:2)
Just my 2 cents
Re: (Score:2)
"Facebook's OSquery" (Score:2)
It's possible this particular application is legit, but - why would anyone with any intelligence allow any app from Facebook to have that level of access to their system?
Or have I answered my own question?
Re: (Score:2)
Not a flaw in MacOS? (Score:2)
The FDA has denied many drug approvals or sent them back to the drawing board on how it is delivered if tests showed that the users could not be counted on to reliably administer them. Difficult to use placement of controls in cars have caused major losses to auto companies on multiple occasions. Usability is an important design feature in many areas of design.
Usability of a security API is a feature that can have bugs. I'm guessing that these tools with bugs were not created by stupid people and they all m